Escape XML entities and quotes