Hi Pavel,
I played around in my dev instance a bit and I believe the documentation may be incorrect - specifically the part that it can be on any kind of field. When I went into the dictionary entry for a string field and added the html_sanitize attribute - the record for the html_sanitize attribute itself explicitly stated that it is only applicable to HTML and Translated HTML fields in the "Applies to description" field.
I'll pass this discrepancy along as a Problem on HI. Either way - one of the two areas is incorrect.
In any event, I might suggest using a Business Rule to parse that field as it is updated, and remove any undesired tags.
Best of luck!
Alex
