$escaped = $query->escapeHTML($message);
# ..
<input type="hidden" name="message" value="$escaped">