commands: handle properly escaping attributes weird characters

XML attribute can not have < > " & % characters, so they need to be
escaped before they are inserted into an XML.
This patch finally handle this case properly, escaping this character
before they are inserted into XML.
In this was attribute can be saved unescaped into the database.

Added some unit tests