How to get escaped file description from node?
As stated in the comments to official documentation:


  It is worth noting that field_get_items() returns raw values the use of which can be a security risk. Passing the raw values through field_view_value() handles the sanitizing of the values.


Links added by me.