escape attribute strings in XML output