use cgi's escape