fixed password hash escaping