escape html and parse html entities vs xss in json