Fixed security issue

I think it's insecure to use raw tags in the message.
To test it send:
```javascript
<script>alert(1)</script>
```