security fixes.  escapings