escape unsafe strings for JSON within HTML