[i/214] properly escaping $username string usages