CRM-12606: do not escape() the strings twice.

Please review to make sure I am not introducing a security issue :)