Defensive xml_encode() calling.