round robin buffering is asking for trouble

[illwieckz]

as @stevenh said in comments of #13 about this code:

char *xml_escape(char *string)
{
    static unsigned char _buf[4][MAXSTRLEN + 8];

The use of this sort of round robin buffering is asking for trouble.

This code is there since the initial revision.