Escape HTML in usernames and message bodies to prevent XSS.