测试html注入攻击，sanitize