use escape_utils instead of CGI