I think the web app changed my sql statement

if looks the same it should be replacing "& lt;" to "<" and "& gt:' to "<", no space between & and lt; otherwise it would be translated again.

select replace (replace ((SELECT ('<?xml version="1.0" encoding="iso8859-1"?>') for xml path ('')) , '<','<') ,'>', '>')