escape some string to pretend dom xss