Escape user input values when used in eval()