escape query string to be displayed in HTML