escape params properly

I think it just ...