xmlEscape function