escape html entities in js