escape JS input from user