[fix] added escaping of all user fields

i think it's actually the other way around.