escaping/sanitizing output to prevent js attacks