I'm building a simple little chat with Node.js and socket.io

When a user types his message, it is broadcasted to all other users.

Server sends the message :

```
io.sockets.emit('fromServerToClient', { "message": message });

```

Client displays it :

```
socket.on('fromServerToClient', function (data) {
    $('#messages').append(data.message + '<br />');
});

```

But when you send something like `<script>alert(1);</script>`, it is executed on every client browser.

This is a serious security flaw and I want to avoid it as much as possible.
I've seen people escape `&, <, > and "` characters, but I don't think it's enough!

How can I be 100% sure of not having a XSS vulnerability on my chat?

By the way, I always specify the charset to avoid UTF-7 attacks.

Thanks for your help.