Properly escape xml characters

Discovered by @mrvdb