use better escaping for query strings