added escaping for the message string in javascript to start to prevent script injection