lib/serializer: excape XML entities
lib/serializer: for..in → Object.keys()