Corrected previous comment!
Note that $content is automatically sanitized/escaped:
> into >
< into <
& into &
" into "
However, single quotes stay unescaped! This is major drawback, if you're creating sitemaps. To fix that and to prevent double escaping, you will need to use XMLWriter::writeRaw or extend the XMLWriter class and escape the content yourself with i.e.
<?php
$content = htmlspecialchars($content, ENT_QUOTES | ENT_XML1, 'UTF-8');
?>
XMLWriter::text or XMLWriter::writeElement would double escape ' and result in &apos;