pick up numeric entity escape and doctype stripping from bleach