I think it's ok for certain characters that we need to escape for html because it's only mms attachment id field, it should not bust mms message creation in backend.