escape remaining xml tags