need uri-escaping, not just basic entities