common: fix \x-style escaping

This was rejecting correct escapes and accepting incorrect ones.
player: quote %-starting strings

Leading percent sign is a quote indicator so it needs to be quoted
itself.