print $query->hidden('message');

##</code><code>##

$escaped = $query->escapeHTML($message);
# ..
<input type="hidden" name="message" value="$escaped">

##</code><code>##

<input type="hidden" name="message" value="[% $message | html %]">