XSS in IE

Though set `sanitize` option to `true` could filter some xss code, but it still miss a `link` case in IE.

use:

`[xss link](vbscript:alert(1&#41;)`

will get a link

`<a href="vbscript:alert(1)">xss link</a>`

this script does not work in IE 11 edge mode, but works in IE 10 compatibility view.
