escape xml output from the api