Move the HTML-escaping JavaScript code to a separate function

We might need to use it in more than one place, and it will be easier
to remember about escaping if we have an utility function for that.

Change-Id: I408a1ce055bb2f07b3c146dfa6eb5122fd5434d8
Merge "Move the HTML-escaping JavaScript code to a separate function"