escape strings in postmessage