#155 Input escaping for model queries