sanitize output of shortcode