escape all user-entered characters except a-z and _