fix xml escaping