fix html injection in page management