properly escapes file names