Escape XML special characters when constructing pop-up content

Addresses #21