fix sharing update, add proper escaping (oc7 backport)

backport of https://github.com/owncloud/core/pull/9867

I just want to give Jenkins the chance to test it once more in stable7