escape js in input data