Escape XML output properly