Escape special characters in query string