I take back my comment. Further testing shows a scenario where escaping `SITENAME` is useful. I have merged the PR. Thank you for your contribution.

I am making similar change in rest of the code. Not escaping properly was messing up few more subtle things.