Better xml sanitization