adding href sanitization