http://www.w3.org/TR/xpath/#NT-Literal
ooh, i see... there are no escape chars in xpath-values at all
* double quotes are escaped like this: ``concat("foo", '"', "bar")``
* single quotes like this: ``concat("foo", "'", "bar")``

so the problem is "how to escape sql" not "how to escape xpath". my bad!