For now, this is not used, it is planned for server side. But yes, we need to escape values, i only forgot about that. I need to do it also in browser part.