xml escape broken