more sanitization in JSONHelper.escape