payment html sanitizing