I have created "edit comment" button in javascript for a website.
Actually everything works fine but the string escapes do not work.
I just tried to put into the edit input something like 

```
 <script> alert(user->id); </script>

```

And it shows the alert !

I tried to do some long escapes like these below but they do not change anything, the alert still appears:

```
 newComment.replace("'","\'");
 newComment.replace("\"","\\\"");
 newComment.replace("(","\(");
 newComment.replace(")","\)");
 newComment.replace("<","\<");
 newComment.replace(">","\>");
 newComment.replace(";","\;");

```

I have also tried to use **encodeURI**, but it shows insantly the encoded comment which do not look good at all...

So what is the proper way to escape the strings now?
I am reading dozens of similar topics but I don't get this at all...