escape all html tags in js string
update readme