fixed html injection in msg