Escape unsafe characters AND brackets from img_src