Preventing HTML script injection in the full content mode