sub escape_for_html {
    @_ or croak 'no json supplied';