query escaping for api calls