added filter that escapes client input