escape strings in xml element attributes