Ну самое простое можно $template прогнать через urlencode(), а на клиенте разобрать обратно через decodeURIComponent().
<?php
$template = implode("\n", [
'<!DOCTYPE html>',
'<html lang="en">',
'<head>',
'<meta charset="UTF-8">',
'<title>Document</title>',
'</head>',
'<body>',
'<p>Lorem ipsum dolor sit amet, consectetur adipisicing elit. Minima consectetur placeat, doloribus, qui eaque quas laborum fuga voluptas dolorum distinctio illo quibusdam quia cum, inventore quos. Quo ipsam sed asperiores.</p>',
'</body>',
'</html>'
]);
$response = array(
"html" => urlencode($template),
"show" => 'true'
);
header('Content-type: application/json; charset=utf-8');
$json = json_encode($response);
echo $json;
?>
<script>
var data = new FormData();
data.append("foo", "bar");
var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.addEventListener("readystatechange", function () {
if (this.readyState === this.DONE) {
console.log(decodeURIComponent(this.responseText));
}
});
xhr.open("GET", "/ajax");
xhr.send(data);
</script>
Средний