fixes issue #25 (#26)

src/main/java/com/redfin/sitemapgenerator/AbstractSitemapUrlRenderer.java

@@ -5,7 +5,7 @@ abstract class AbstractSitemapUrlRenderer<T extends WebSitemapUrl> implements IS
 	public void render(WebSitemapUrl url, StringBuilder sb, W3CDateFormat dateFormat, String additionalData) {
 		sb.append("  <url>\n");
 		sb.append("    <loc>");
-		sb.append(url.getUrl().toString());
+		sb.append(UrlUtils.escapeXml(url.getUrl().toString()));
 		sb.append("</loc>\n");
 		if (url.getLastMod() != null) {
 			sb.append("    <lastmod>");
@@ -35,7 +35,7 @@ abstract class AbstractSitemapUrlRenderer<T extends WebSitemapUrl> implements IS
 		sb.append(':');
 		sb.append(tagName);
 		sb.append('>');
-		sb.append(value);
+		sb.append(UrlUtils.escapeXml(value.toString()));
 		sb.append("</");
 		sb.append(namespace);
 		sb.append(':');

src/main/java/com/redfin/sitemapgenerator/SitemapIndexGenerator.java

@@ -225,7 +225,7 @@ public class SitemapIndexGenerator {
 		for (SitemapIndexUrl url : urls) {
 			out.write("  <sitemap>\n");
 			out.write("    <loc>");
-			out.write(url.url.toString());
+			out.write(UrlUtils.escapeXml(url.url.toString()));
 			out.write("</loc>\n");
 			Date lastMod = url.lastMod;
 			

src/main/java/com/redfin/sitemapgenerator/UrlUtils.java

@@ -2,8 +2,31 @@ package com.redfin.sitemapgenerator;
 
 import java.net.URL;
 import java.util.HashMap;
+import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 class UrlUtils {
+	private static Map<String,String> ENTITIES = new HashMap<String,String>();
+	static {
+		ENTITIES.put("&", "&amp;");
+		ENTITIES.put("'", "&apos;");
+		ENTITIES.put("\"", "&quot;");
+		ENTITIES.put(">", "&gt;");
+		ENTITIES.put("<", "&lt;");
+	}
+	private static Pattern PATTERN = Pattern.compile("(&|'|\"|>|<)");
+
+	static String escapeXml(String string){
+		Matcher matcher = PATTERN.matcher(string);
+		StringBuffer sb = new StringBuffer();
+		while(matcher.find()) {
+		    matcher.appendReplacement(sb, ENTITIES.get(matcher.group(1)));
+		}
+		matcher.appendTail(sb);
+
+		return sb.toString();
+	}
 
 	static void checkUrl(URL url, URL baseUrl) {
 		// Is there a better test to use here?