use URI encoding instead of CGI escape