input.js: add html escaping for filename