Rfc: escape javascript