this looks leaky... why not escape all special chars?

\ " ' & < >