[Security] Sanitize HTML user input