fix CGI escaping