I'm pretty sure that it's WSDL's responsibility to do XML escaping and not yours.
this is c:out escapeXml="false" :
& %amp;
this is a test
this is c:out escapeXml="true" :
& %amp; <p> <html><table><th>this is a test</th></table></html>
*****************************************************<p>
this is c:out escapeXml="false" :<br>
& %amp; <p> <html><table><th>this is a test</th></table></html>
</p>
<p>
this is c:out escapeXml="true" :<br>
& %amp; <p> <html><table><th>this is a test</th></table></html>
</p>