2nd fix for bug 105960 (xml.cgi and other future xml pages generate invalid XML). Some illegal characters were still not excluded - Patch by David Marshall <dmarshal@yahoo-inc.com> r=LpSolit