Fix missed escaping

All variables and other unknown values (i.e. options from the database) should be escaped when they're used.

The `json_encode( json_decode() )` is kind of a lame hack to make sure json data is properly escaped.
Merge pull request #12 from joshbetz/patch-1

Fix missed escaping