CGI escape _id fields properly