Using a replace function instead

@masatokinugawa was so kind to email us about a security vulnerability.

This pull implements his suggestion of using a `replace(/\\/g,"\\\\")` instead of `split("\").join("\\")`

@JamesMGreene @ptoomey3 @jnewland @mastahyeti