added over the top escaping to satisfy VIP

See https://github.com/GigaOM/gigaom/issues/4349

Note: this does not yet address sanitization of `QUERY_STRING`.

This change also removes the use of `extract` to address https://github.com/GigaOM/legacy-pro/issues/2267