null safety
handle emoji and other unicode chars outside the xml friendly ranges by escaping