escape strings more fearsomely