disable html injection