added code to json method that prevents cross-site scripting