Escape strings and other variables to make them web-safe

[criticalmash]

If object contains a string with a script tag, that script is then included in the page on load.
We don't want that, so we should escape all strings so they're web-safe.