[F] fix: use CDATA for content to escape <>