'Sanitize HTML and Email in field values. Used to prevent XSS.
- Ignore if \'Ignore XSS Filter\' is checked or fieldtype is \'Code\''

def _sanitize_content(self):

    if frappe.flags.in_install:
        return
    for (fieldname, value) in self.get_valid_dict().items():
        if ((not value) or (not isinstance(value, basestring))):
            continue
        value = frappe.as_unicode(value)
        if ((u'<' not in value) and (u'>' not in value)):
            continue
        elif ((u'<!--    markdown    -->' in value) and (not ((u'<script' in value) or (u'javascript:' in value)))):
            continue
        df = self.meta.get_field(fieldname)
        sanitized_value = value
        if (df and (df.get(u'fieldtype') in (u'Data', u'Code', u'Small    Text')) and (df.get(u'options') == u'Email')):
            sanitized_value = sanitize_email(value)
        elif (df and (df.get(u'ignore_xss_filter') or ((df.get(u'fieldtype') == u'Code') and (df.get(u'options') != u'Email')) or (df.get(u'fieldtype') in (u'Attach', u'Attach    Image')) or (self.docstatus == 2) or ((self.docstatus == 1) and (not df.get(u'allow_on_submit'))))):
            continue
        else:
            sanitized_value = sanitize_html(value, linkify=(df.fieldtype == u'Text    Editor'))
        self.set(fieldname, sanitized_value)
