dhtmlxCombo.enableFilteringMode & java connector Example


I’m having trouble retrieving “dynamic” option list for a combo using enableFilteringMode. I’m not sure which of the javacript client code or the java servlet code is faulty.
Could you point me in the right direction or give me an example on how to accomplish it.
(basically, I’d like to replicate the 100,000 records sample found here [url]http://www.dhtmlx.com/docs/products/dhtmlxCombo/samples/04_filtering/01_combo_big_db.html[/url]).

Client side (javascript)

var ProjectsSH_select;
	ProjectsSH_select.enableFilteringMode(true, 'DBService?action=getShareholdersNames', true, true);

Server side (java running on Tomcat 7)

	private void getShareholdersNames(HttpServletRequest req,HttpServletResponse res){
		String fields="ProjectSH_Name";
		String id="ProjectSH_Name";
		ComboConnector cc;
		Connection conn=null;
		try {
			cc=new ComboConnector(conn,DBType.MySQL);		
			cc.servlet(req, res);			
			cc.render_table("ShareHoldersList", id,fields);
		} catch (SQLException e) {

The ‘ShareHoldersList’ table contains only two columns: ‘ProjectSH_Name’ and ‘CompanyID’, respectively VARCHAR and INT.

When I type a letter in the combo, a request is issued to the server :

the code is correctly executed on the server and gives back an XML string of type:

<?xml version='1.0' encoding='utf-8' ?>
	<option value='Company 1' >Company 1</option>
	<option value='Company 2' >Company 2</option>
	<option value='Company 3' >Company 1</option>

But instead of filling the combo with this information, an alert messagebox is shown on the web page displaying this xml and nothing happens to the combo…

The log generated by the ‘ComboConnector’ is :

Log started, Fri Dec 13 10:52:17 CET 2013
DB query 
SELECT ProjectSH_Name,ProjectSH_Name FROM ShareHoldersList WHERE ProjectSH_Name LIKE 't%'

Done in : 125ms

What am I doing wrong !?!?

I half answer to myself.
My code is “almost” correct. The only problem is that I have to escape the results. My data contains forbidden characters like quotes, thus the XML response is malformed.

So now, given my previous code, what would be the best way to escape the data?

PS: Actually, I was expecting that the connector would already enclose the data in CDATA…