only escape / for the query.
others chars should not be problematic.