Use htmlspecialchars() not htmlentities in xml export for validity