test for cdata escape in urls