Protect against HTML names