escape html client side