Sanitization is not working.

I think you're misunderstanding the purpose of this module, it's not about XSS filtering or stripping HTML. To refer to the project description:

This module provides a Webform handler that allows submission data of certain form elements to not be stored in the database. The submission data can still be used in other handlers preceding the Sanitize submission handler.

dieterholvoet → closed merge request !3