Added xml escapes to name and fullname of user to_xml