escape json and html