add function to escape submitted strings