add "escape" and "urlencode" to imporve site security