Added HTML escaping - the JSON response does properly encode single / double quotes, but not the HTML tags (<, >) and thus the payload could be executed in XSS attack - thanks Mikko Saario