switched to CGI::escape for query param escaping