real escape string validation