all properties of user are converted by escape