fix readme to try to prevent html injection