escape html from message

not a good idea to render content provided by evil users