Fixed security issue

I think it's insecure to use raw tags in the message.
To test it send:
<script>alert(1)</script>