escape illegal chars (quote, backslash...)