My fault, actually working correctly.

DECLARE @t TABLE(a VARCHAR(100))

INSERT @t SELECT 'abc' UNION ALL SELECT 'd<c>f' UNION ALL SELECT 'ghi' UNION ALL SELECT '<">'

SELECT

CAST(

(SELECT a+',' FROM @t FOR XML PATH('')) AS XML

).query('/.[1]').value('.','nvarchar(200)')