properly escaping URL appearing inside xml