XSS string encoding helper