Ducksay: make queries with user-defined text 'safe'

Fixes #1307, cc @moollaza