escape input text during var inject