add encodeURIComponent to user supplied query string to escape special chars