escape raw strings returned to prevent xss attacks, also, this is the
cleanest JavaScript I have ever written.