commands: attributes are all unescaped in the database

Now all attribute are stored unescaped in the database.
They are escaped only when inserted into a kickstart, which is
much simpler and more user friendly