Since you are setting the value of that input field as encoded url, thats why it is visible to users.
To avoid it use hidden input field and set it value to encodedURI
function encodeBody() {
document.getElementById(hiddenfield).value = encodeURI(document.getElementById(txtBodyID).value);
}