Escape strings before putting them into XML.

Strings are not escaped before being put into the XML. This leads to malformed XML when the string contains for example an ampersand.