Fix XSS security bug

Tags and Script in source data parsed as html and cause XSS attack.

I fixed problem.

example infected data source:
```json
[
    "yes <b>this is xss</b>",
    "go <script>alert('xss')</script>",
    "and <b>ha ha ha</b>"
]
```

For more detail see 843eec3