escape html in json request