Write a JavaScript function to escape a HTML string.