JavaScript HTML escaper function