Ensure onclick handlers are escaped only once