(JavaScript, as far as I am aware, does not allow for interpolation of variables. You have to concatenate them in using the + sign. As for escaping, JS works just like you'd expect it to.)
Am I mistaken, or will something like this work?
sub alert {
my $mesg = shift;
print "alert(\"$mesg\")\n";
}