parameters weren't being escaped right