only allow valid HTML tags on web rendering