escape and replace html entities in json vs xss