escape quotes for js