Escapes the HTML of all strings attached to a JSON encodable object before stringifying it. Does not detect cycles.

JSON-safeStringify.js

var _ = require('underscore');
var escape = require('escape-html');

  function recur(item) {
    var ret;
    if (_.isObject(item) || _.isArray(item)) {
      ret = new item.constructor();
      _.each(item, function (val, key) {
        ret[key] = recur(val);
      });
    } else if (_.isString(item)) {
      ret = escape(item);
    } else {
      ret = item;
    }
    return ret;
  }

  module.exports = function (item) {
    JSON.stringify(recur(item));
  };