Add missing escaping of user input (issue #58)