Escape user input in json

This prevents broken json objects from being saved to the database.

The upload process saves the json object as a value of a hidden input in the HTML markup of the page.  When a user has a single quote in the title, filename, or comment, the resulting value can create invalid markup.

Take this for example:
```
<input type='hidden' id='693963X7X16' name='693963X7X16' value='[{ "title":"test's","comment":"testcomment","size":"65.435","name":"Homer-Doughnut.jpg","filename":"fu_s4i55hsmibyuazz","ext":"jpg" }]' />
```
Here, you can see that the `title` in the json object contains a single quote, which closes the value attribute of the input early.

Because of this, when the form is submitted, only ``[{ "title":"test's`` is saved to the database, resulting in corrupted data.