fix: bind empty message string as plain text to avoid xss

fix: bind empty message string as plain text to avoid xss #801