Fixed an issue where string may not always be escaped properly

Switched from string formatting to NSXMLEelement. It’s smarter than me
and knows how it should escape things.