escaping all the user strings