#532 fix escape in sanitize