sanitize user input

to prevent XSS and reflection attacks, disallow html in all user input