David Balazic pointed out the lack of checks for a valid %XX code when

we unescape a string. We now check and decode only valid %XX strings.