[fix] added escaping of all user fields except the password