Escape XML special characters when constructing pop-up content