Need to escape query params as well.