Fixed security issue by doing escape/unescape