Added an escape only HTML from strings that could do a injection attack