escape user-provided strings used in regular expressions