correctly escape strings passed to javascript