Add escaping to the user variables

Since I don't know the language and didn't want to create a dev environment for this, I committed a wild guess.