fix: sanitize() double encode special characters

fix: sanitize() double encode special characters #6864