So reading this just made me realise that we've still got the issue of security that I was originally trying to solve - namely that a hacker connecting into talkilla, could send me some form of html, that my chat window then opens & executes - which is why we need to sanitise on the incoming message. For some reason, I thought your methods were already handling it this way.