Good points -- thank you. Yes, it's time for me to get better acquainted with a proper xml output module, or at least apply the appropriate module to do entity encoding on those attribute values.

(And I must confess to being queasy about the <d> element usually just containing character data but sometimes containing <fullval> and <sd> elements. I probably should shorten the former to <fv> and use it in every instance.)