properly quote/escape user content in comments of constructed queries