sanitize special characters in url and filenames