switch to express; escape strings in one place