prevent evil scripting attacks

it was possible to provide javascript code in the message, so message is now escaped