Comment by hunter2_

The escape string doesn't need to be hard to guess, it can be as simple as a single character. The user interface (or whatever source of untrusted data) sanitizes that particular character before handing it off to the sensitive function, either by dropping it or escaping it such that it doesn't signal the end of untrusted data.