Does `email` need to be escaped here?