escape javascript so it can be parsed as xhtml