Prevent code injection within Router::urlFor with preg_quote