add placeholders before CGI escapes