I believe the proper way to encode quotes in XML is via "
See this answer:
How do I escape double quotes in attributes in an XML String in T-SQL?
The same would go for any other ‘special’ characters you wish to include as data. Essentially, you should use the same encoding you would use in HTML attributes.