do a bunch of escaping, & < > quotes newlines etc.
add poshcriber
guard for "", which signals empty string