You should either build a dom and serialise it to XML, or aggressively and consistently escape every single variable being embedded into XML (regardless of whether it is supposed to be a string, number or whatever).

Especially titles should be escaped for obvious reasons.