escape html special chars in JS instead of BE