Only escape XML-related characters.