Fix Regex: Do not pass unescaped user input

...