correctly escape script and style contents