How to safely remove unwanted HTML from user input