Escaping HTML in messages