escapeXml only code