Fix HTML injection