password not actually used in a DB query, so escape unnecessary and will potentially modify the intended password.