escape shell characters to suppress code injection