Add CGI.escape to get user