escape all printed HTML taken from JSON object