Escape the username to prevent js injection