add html_safe, should correct
sanitize post