Remove XSS from tags attribute