prevent html escape in js code