diff --git a/router/api.js b/router/api.js
index 76408a8..58da83b 100644
--- a/router/api.js
+++ b/router/api.js
@@ -50,13 +50,18 @@ module.exports = (fastify, opts, done) => {
       let file = '<?xml version="1.0" encoding="UTF-8" standalone="yes"?><gpx xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.topografix.com/GPX/1/1" version="1.1" creator="EMTAC BTGPS Trine II DataLog Dump 1.0 - http://www.ayeltd.biz" xsi:schemaLocation="http://www.topografix.com/GPX/1/1 http://www.topografix.com/GPX/1/1/gpx.xsd">'
       const data = JSON.parse(val);
       const gen_wpt = (name,desc,latlon,icon="Flag") => `<wpt lat="${latlon[0]}" lon="${latlon[1]}"><ele>0</ele><name>${name}</name><cmt>-</cmt><desc>${desc}</desc><sym>${icon}</sym></wpt>`
+      const esc_str = (str) => str.replace('"',"&quot;").replace("'","&apos;").replace("<","&lt;").replace(">","&gt;").replace("&","&amp;").repace("\n","...")
+      '   
+      <   &lt;
+      >   &gt;
+      &   &amp;
       data.main.forEach(a => {
-        file+= gen_wpt(a.hotel.name, a.hotel.notes.replace("\n","... ").replace("&","\\&"), a.hotel.latlon, icon="Hotel");
+        file+= gen_wpt(esc_str(a.hotel.name), esc_str(a.hotel.notes), a.hotel.latlon, icon="Hotel");
         a.places.restaurants.forEach(b => {
-          file+= gen_wpt(b.name, b.notes.replace("\n","... ").replace("&","\\&"), b.latlon, icon="Restaurant");
+          file+= gen_wpt(esc_str(b.name), esc_str(b.notes), b.latlon, icon="Restaurant");
         });
         a.places.activities.forEach(b => {
-          file+= gen_wpt(b.name, b.notes.replace("\n","... ").replace("&","\\&"), b.latlon, icon="Tree");
+          file+= gen_wpt(esc_str(b.name), esc_str(b.notes), b.latlon, icon="Tree");
         });
       });
       file+="</gpx>";