strip illegal xml characters from thug XML