Escape request params to prevent XSS