added escaping for usernames