escapes special characters on post request