cgi escaping of cids