escape all non-alphanumeric chars