properly escape xml characters