These values need to be XML escaped. The wiki, space and page names (from the request) can contain special XML characters.