fix html injection in chat