fix escape function, drop separate CGI class