sanitize HTML
fix #557