make user input safe from html injection