You have to be careful of non-alphanumeric characters. Try replacing '&' with & I beleive there is an escape() function in one of the xml modules that will do that kind of escaping on strings so thay may safely be placed into XML.