Update api.php

XSS patch
Merge pull request #104 from japp-0xlabs/patch-2

Patches' the API controller to escape request parameter to avoid potential XSS.