escape string for commands