escape query in query validator