escape values that are used in the URL