Match coding style.
Don't escape twice.
Added new test case with malicious input.