xss fix

fixed messages which were susceptible to an xss injection