Work harder to get escaping right

Throughout the module, assume mostly that input from a user has not been escaped; allow this to be overridden when the same routine is used internally for results from searches, get-child etc. where the path will already have been escaped.