html sanitization for GH