escape a couple more characters in cdata