According to [this post](http://stackoverflow.com/questions/2822774/php-is-htmlentities-sufficient-for-creating-xml-safe-values) on Stack Overflow, `htmlspecialchars` is more appropriate than `htmlentities`.

But according to [this post](http://stackoverflow.com/questions/3957360/generating-xml-document-in-php-escape-characters) I should have just created a Text node and let `DOMDocument` handle the escaping.  Next time.