Send JSON with encoded HTML to avoid XSS problem