escape data before outputing to XML