I've noticed that the XML document that comes out of the API is not validated. Basically if you have any ampersands in a text field you'll get a broken XML document. Bringing this up with the Quickbase support team I was not able to get across to them that it was being produced from their API. They kept saying it was the XML converter at issue. So until they decide that it is a bug and address it I've found a regex/replace method you can run on the document.
var replacement = "&$1";
xml = xml.replace(regex, replacement).replace(regex, replacement);
None of the other special characters are escaped either but they don't seem to break converters such as xml2json.min.js.