fix sharing update, add proper escaping