Escape user input from JS/HTML.