Side-note: I misunderstood the working of cb.literal(). Apparently, the burden of escaping input lies with the API user. That's unfortunate and does complicate things...