I normally use the script element to work on strings, and then output to a new webharvest variable. For example:
<var-def name="r_output">
A long string with lots of funny characters
new lines and & and ' single and " double quotes
</var-def>
<var-def name="r_output2">
<script return="r_output2">
<![CDATA[
String r_output2 = "\n" + r_output.toString().replaceAll("&", "&").replaceAll("\\t","").replaceAll("\\n","").replaceAll("\\r","");
]]>
</script>
</var-def>
<var name="r_output2"/>
as a side note, instead of quoting your apostrophes in quotes it is much better to quote the whole chunk of data eg: "a string with a ' single quote"
instead of a string with a "'" single quote