Your message is being parsed as HTML. You can either escape the HTML entities on the server (depending on your server side language, but preferred regardless), or you can use text nodes to set the textContent
of the message, rather than HTML;
var markup = $(jQuery.parseHTML('<div class="message"><span class="userName"></span></div'));
markup.find('.userName').text(fromUserName);
markup.append(document.createTextNode(message));
$('#' + ctrId).find('#divMessage').append(markup);
... but just to emphasize, you should really be encoding this on the server.