does this protect against HTML injection?