Use cleanInput() on incoming messages

This prevents XSS if one were to send messages using socket.io from the console.