need to escape URI because the input string may not be escaped properly