use htmlspecialchars in xmlify and htmlspecialchars_decode in unxmlify

should fix #898
could break something else?