Is there an alternative for HTML macro that prevents against cross-site scripting and provides similar functionality?