escape HTML entities to avoid XSS attacks in DataTables

BTW, per recommendation of http://datatables.net/manual/server-side, the parameter `draw` is coerced to integer