escape all users input strings