Escape special characters to HTML entities in JavaScript