fix html or script injections