os and XSS proctection in message