Escape ' and / when using escape in xmltree

The OWASP XSS prevention cheat sheet advise to escape the `'` and `/` characters (see `RULE #1` on https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet).