prevent xss in messages