use serverside sanitization of html to prevent JS from parsing in JSON maliciously
resolve merge conflict