Changed masking.
Use a dash when no message was given.
Switch to HTML.
Escape HTML.