properly escape all input