1. escape the message in order to avoid the XSS