Please, can you elaborate more? The approach is cleaning the tags with a regexp but then allow the browser to clean the rest for avoid injection of tags like <script> or similar