added over the top escaping to satisfy VIP

See https://github.com/GigaOM/gigaom/issues/4349

Note: this does not yet address sanitization of `QUERY_STRING`.