What do I need to escape in my HTML (JSON response)

Answer 1

You're HTML values are OK, but the keys of the JSON object must be enclosed in quotes.

From the JSON RFC:

2.2. Objects

An object structure is represented as a pair of curly brackets
surrounding zero or more name/value pairs (or members). A name is a
string.

and

2.5. Strings

The representation of strings is similar to conventions used in the C
family of programming languages. A string begins and ends with
quotation marks.

Also, if you output this JSON object inside the script tags of an HTML page, you must escape the "