escape string from evil strings