properly escape special chars