Escape subject and body so we cant have <script>alert</script> fun