delete html lang=en
prevent mongodb injection (newbie grade)