title: Prevent chat messages from executing scripts in the browser after being sent from MySQL server?
body: <p>I am making a chat application where people can send messages back and forth. I just realized that when submitting a message, it will execute the script in the browser. If I submit the message <code>&lt;script&gt;alert("hello");&lt;/script&gt;</code> My browser will execute the script, and the message div will have no message content. When I look at the server, the "content" column has the script inside of it. When I load all of the messages between the user and I, it will run the script... again. The issue im running into is, how do I display the messages in just text, without running the script? I am forming large HTML blocks inside the php sever, then <code>echo</code> each one to the <code>AJAX</code> requests that appends them in the conversation div. As a simplified version of what I am doing this is basically the text block I <code>echo</code> out after getting the values from the database.</p>
  
  <pre><code>$chat_message='
  &lt;div class="messaging-block"&gt;
      &lt;div id="date"&gt;'.$date.'&lt;/div&gt;
      &lt;div id="username"&gt;'.$fname.' '.$lname.'&lt;/div&gt;
      &lt;div id="content"&gt;'.$content.'&lt;/div&gt;
  &lt;/div&gt;';
  echo $chat_message;
  </code></pre>
  
  <p><strong>AJAX</strong></p>
  
  <pre><code>$.ajax({
  type: 'POST',
  url: 'get-chat-messages.php',
  dataType: 'html', //have tried 'text' as well
  data: 'convid=' + conversation,
  success: function(response) {
    $("#conversation-div").append(response);
                        }        });
  </code></pre>