var but = document.createElement('button');

var my_string = '123-45-lol , @%# ';

var but.setAttribute('onclick', 'my_function( " '+my_string+' " )');

// Or to use addEventListener() instead of setAttribute() ?