sanitize commands for xml entities " ' < > &