Security fix : escape special chars