PHP-serialization -> JSON encoding

Phasing out serialize() / unserialize() in favor of JSON-encoding;
JSON-encoding is actually *faster* than serialization, and it doesn't
come with the security issues that unserialize() introduces (remote code
execution through injecting serialized data).

To be tested.
Moved HTML tags from __ params into template

Parameters are plain text, template is considered pre-encoded HTML;
hence, using tags in the parameters does not work as desired.

Fixes #1064