Update xml.php

If we do not use htmlspecialchars, you can get an error ("EntityRef: expecting ';')