Fix: escape xml in title attribute