You're creating a UTF-8 file, so why are you bothering to converting anything but "&" and "<" (and """ in attribute values) to entities?

The header you're adding is also fishy. Specifying a Content-Type header in an XHTML document is useless (as the encoding comes from the <?xml?> directive), and the trailing "/" is invalid in HTML.