Always use first_name in link, and escape it

I'm disappointed that you added that to TODO
instead of resolving it immiedetly, @poeti8.

Also added escapeHtml, so the bot doesn't break
when someone has something html-like in first_name.

TODO.md

@@ -27,7 +27,7 @@
 - [ ] All command be available with both `!` and `/`.
 - [x] Auto remove commands if they're not sent by admins.
 - [x] Auto remove joining messages.
-- [ ] Use first name instead of username for link.
+- [x] Use first name instead of username for link.
 - [ ] Commands work with username too.
 - [ ] Commands should tell which admin sent the command.
 - [ ] Ban and remove Arabic/Russian/Indian text.

utils/tg.js

@@ -1,7 +1,10 @@
 'use strict';
 
-const link = ({ id, username, first_name }) =>
-	`<a href="tg://user?id=${id}">${username ? username : first_name}</a>`;
+const escapeHtml = s => s
+	.replace(/</g, '&lt;');
+
+const link = ({ id, first_name }) =>
+	`<a href="tg://user?id=${id}">${escapeHtml(first_name)}</a>`;
 
 const deleteAfter = ms => ctx =>
 	setTimeout(() =>