Javascript 清理 : The most safe way to insert possible XSS html string