The replacement part is not escaped, see http://phpfashion.com/speky-a-parky-v-nahrazovani-retezcu. Maybe we can find out better way without replace().