Entity escaping in XML output

[dacook]

According to https://www.sitemaps.org/protocol.html#escaping, the following entities in XML content should be escaped:

Character		Escape Code
Ampersand	&	&
Single Quote	'	'
Double Quote	"	"
Greater Than	>	>
Less Than	<	&lt;

But I've observed at least the ampersand is not escaped, eg:

<loc>https://members.ceresfairfood.org.au/categories/fruit-&-veg</loc>