protect HTML