Prevent html injection on previews