improve LDAP filter escaping