[fix] added escaping of all user fields