No need to escape the return values of md5/sha1

the return values of md5/sha1 are trusted, only [0-9a-f] included, no need to escape them.