escape query string