bugfix: XML tag attributes now converted to htmlspecialchars