string sanitizing doesn't encode quotes