escape html in chat messages