if you just replace " with \" in userinput, it is not sufficient