use sanitize-html to prevent xss
add dependencies