properly escape input (handle for ' et al)