Use the browsers built in escaping: `return new Option(str).innerHTML;`