<user username="tomcat" password="<must-be-changed>" roles="tomcat"/>

Node_List_User = xmldoc.getElementsByTagName('user')
for node_list2 in Node_List_User:
    if (node_list2.getAttribute('password') == 'must-be-changed' or node_list2.getAttribute('password') == 'tomcat' or node_list2.getAttribute('password') == 'password'):
        comment2 = xmldoc.createComment(node_list2.toxml())
        print comment2.toxml()

xml.parsers.expat.ExpatError: not well-formed (invalid token): line 35, column 36