Fix security bug with html.