fixed broken html sanitizer