properly escape xml