fix src and href sanitation