Invalid user supplied messages should be escaped HTML entity escaped.