Escape id parameter, which could contain XSS