Fix missed escaping

All variables and other unknown values (i.e. options from the database) should be escaped when they're used.

The `json_encode( json_decode() )` is kind of a lame hack to make sure json data is properly escaped.