prevent xss, sadly this means no link detection, sorry