Bug #19776 - escape arguments to prevent injection