NXP-13605 proper escape of lang parameter that can come from the request