XML escape fields for return invoices

Same type of thing as 3fa8c5bb5f6945dca7f33caea3d358361691636e.

Ticket ENG-683