escape parameters properly (see bug 978288 comment 15)