Potential security problem with HTML Editor