Use XMLURL instead of xml_escape for URLs