Quote all needed XML chars. See #263.

Includes testcase.