escaping characters for xml encoding