add XHTML escapes around inline JavaScript.