we don't need to escape characters coming in; it's all done for us