diff --git a/lib/checkclass.cpp b/lib/checkclass.cpp
index fa2c05023..e2310b398 100644
--- a/lib/checkclass.cpp
+++ b/lib/checkclass.cpp
@@ -2934,7 +2934,7 @@ std::string CheckClass::MyFileInfo::toString() const
 {
     std::string ret;
     for (const MyFileInfo::NameLoc &nameLoc: classDefinitions) {
-        ret += "<class name=\"" + nameLoc.className +
+        ret += "<class name=\"" + ErrorLogger::toxml(nameLoc.className) +
                "\" file=\"" + ErrorLogger::toxml(nameLoc.fileName) +
                "\" line=\"" + std::to_string(nameLoc.lineNumber) +
                "\" col=\"" + std::to_string(nameLoc.column) +
diff --git a/lib/ctu.cpp b/lib/ctu.cpp
index af3e74fb7..ad3a02c79 100644
--- a/lib/ctu.cpp
+++ b/lib/ctu.cpp
@@ -92,7 +92,7 @@ std::string CTU::FileInfo::FunctionCall::toXmlString() const
     std::ostringstream out;
     out << "<function-call"
         << toBaseXmlString()
-        << " " << ATTR_CALL_ARGEXPR << "=\"" << callArgumentExpression << "\""
+        << " " << ATTR_CALL_ARGEXPR << "=\"" << ErrorLogger::toxml(callArgumentExpression) << "\""
         << " " << ATTR_CALL_ARGVALUETYPE << "=\"" << static_cast<int>(callValueType) << "\""
         << " " << ATTR_CALL_ARGVALUE << "=\"" << callArgValue << "\"";
     if (warning)
@@ -103,10 +103,10 @@ std::string CTU::FileInfo::FunctionCall::toXmlString() const
         out << ">\n";
         for (const ErrorMessage::FileLocation &loc : callValuePath)
             out << "  <path"
-                << " " << ATTR_LOC_FILENAME << "=\"" << loc.getfile() << "\""
+                << " " << ATTR_LOC_FILENAME << "=\"" << ErrorLogger::toxml(loc.getfile()) << "\""
                 << " " << ATTR_LOC_LINENR << "=\"" << loc.line << "\""
                 << " " << ATTR_LOC_COLUMN << "=\"" << loc.column << "\""
-                << " " << ATTR_INFO << "=\"" << loc.getinfo() << "\"/>\n";
+                << " " << ATTR_INFO << "=\"" << ErrorLogger::toxml(loc.getinfo()) << "\"/>\n";
         out << "</function-call>";
     }
     return out.str();
@@ -130,7 +130,7 @@ std::string CTU::FileInfo::UnsafeUsage::toString() const
         << " " << ATTR_MY_ID << "=\"" << myId << '\"'
         << " " << ATTR_MY_ARGNR << "=\"" << myArgNr << '\"'
         << " " << ATTR_MY_ARGNAME << "=\"" << myArgumentName << '\"'
-        << " " << ATTR_LOC_FILENAME << "=\"" << location.fileName << '\"'
+        << " " << ATTR_LOC_FILENAME << "=\"" << ErrorLogger::toxml(location.fileName) << '\"'
         << " " << ATTR_LOC_LINENR << "=\"" << location.lineNumber << '\"'
         << " " << ATTR_LOC_COLUMN << "=\"" << location.column << '\"'
         << " " << ATTR_VALUE << "=\"" << value << "\""