fix #15 all inputs are now escaped