Address code review: more reliable string escaping