Fix #751. The query string is now XML escaped, as it is used as an
attribute value.