Fix XML injection issue