ownly plain elements && escape all attributes except href and target