--strip tags for signup. user can still try to sign up with malicious code but their username and email and password being sent to the database will be without tags making it harmless.