3.2 escape_once isn't escaping single quotes and is double-escaping hex-encoded entites

Related to #9088