Escape HTML in messages