prevent html access