sanitize input

sanitize input to prevent xss vulnerability

http://www.tripwire.com/state-of-security/security-data-protection/wysiwyg-editors-xss/

thanks Ciro Santilli!
Merge branch 'hotfix/xss'
Merge branch 'master' into develop