What I normally do is restrict communication to sole A-Z, a-z and 0-9. And store everything locally on each persons computer with a really simple encryption method so you don't actually see the chat. This protects you from liability as well as any exploits due to not sanitizing the data.

Literally just a "GET getChatMessage(AUTH, USER)" and a "POST sendChatMessage(AUTH, USER)". And inside getChatMessage, delete all messages that are sent.