sanitize_html: stripping scripts with regex

Now escaping closing brackets.