CGI escape values only