properly shield graph_id from disallowed characters