remove "html injection"