This is not Django, escaping is done manually