Fix #751. The query string is now XML escaped, as it is used as an

attribute value.