escaping invalid XML chars like a Boss