How to escape XML characters in TSQL before converting to XML?
Use for xml path to create XML instead of casting.

select @YourVariable for xml path(''), type


Empty string in the path expression and the absence of an alias on the returned column will give you your string back as xml.