escape strings in XML output