There is definitively not enough escaping. I think that in YaST is method to escape params.