Must decode entities before replacing tags and tokens
Strip tags before using the var, even insert tags could add HTML