Fixed HTML injection into input