Avoiding entitized characters when using FOR XML PATH for string concatenation
Try changing you statement to match this:

FOR XML PATH(''), TYPE).value('(./text())[1]','varchar(max)')


This uses the .value xml method to solve your entitization problem.