Escape XML characters, they are unsafe