HTML sanitization (untested, unused)