$login should be escaped