def esc (s, is_attribute=False):
    """ escape XML special charcters 
    Parameters:
      is_attribute if True, also escape " and ' for attribute values
    Returns:
      the escaped string
    
    """
    s = s.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;")
    if is_attribute:
        return s.replace('"', "&quot;").replace("'", "&apos;")
    else:
        return s