sanitize html + highlight