Added htmlentities() to prevent HTML injection in messages