fix string escape for anti-XSS