Escape HTML in js-generated confirmation messages