Escape and sanitize

@chrisscott rewrote a bit to address #2 and #3