Fixed potential JSON injection by using #to_json.

`"data: \"#{user_input}\""` is an bug-pattern.