escape/unescape into XML