escape XML characters