prevent XSS attacks by sanitizing html (this is different then esacping!)