added character escaping for xml