added html sanitization