escape a query string