escape special chars correctly this time. fixes #2