Html and js escaping (prevent xss exploits)