Sanitize HTML output