only escape user parameters on cmd_extscript