<?xml version='1.0' encoding='UTF-8' ?>
<submission xmlns="http://opendatakit.org/submissions" xmlns:orx="http://openrosa.org/xforms">
    <data>
        {{ submission_data|safe }}
    </data>
    {% for media in media_files %}<mediaFile>
        <filename>{{ media.filename|safe }}</filename>
        <hash>md5:{{ media.file_hash }}</hash>
        <downloadUrl>{{ host }}{% url "onadata.apps.viewer.views.attachment_url" 'original' %}?media_file={{ media.media_file.name|safe }}</downloadUrl>
    </mediaFile>{% endfor %}
</submission>

<?xml version='1.0' encoding='UTF-8' ?>
<submission xmlns="http://opendatakit.org/submissions" xmlns:orx="http://openrosa.org/xforms">
    <data>
        {{ submission_data|safe }}
    </data>
    {% for media in media_files %}<mediaFile>
        <filename>{{ media.filename|safe }}</filename>
        <hash>md5:{{ media.file_hash }}</hash>
        <downloadUrl>{{ host }}{% url "onadata.apps.viewer.views.attachment_url" 'original' %}?media_file={{ media.media_file.name|urlencode }}</downloadUrl>
    </mediaFile>{% endfor %}
</submission>

Replace safe filter with urlencode filter for a query string arg value
Replace safe filter with urlencode filter for a query string arg value
