Escape characters to prevent JS injection