escape commands in xml