code: public static String escapeForXML(String inString) {
      if (inString == null)
        return null;
      String outString = inString;
      outString = replace(outString, "&", "&amp;");
      outString = replace(outString, "<", "&lt;");
      outString = replace(outString, ">", "&gt;");
      outString = replace(outString, "\"", "&quot;");
      outString = replace(outString, "'", "&apos;");
      // We'll escape all chars not in this set (Safe)
      String validChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890 &#;-_=+:,.?/";
      for (int i = 0; i < outString.length(); i++) {
        char c = outString.charAt(i);
        if (validChars.indexOf(c) == -1) {
          // Escape the character
          outString = replace(outString, "" + c, "&#" + ((int) c) + ";");
        }
      }
      return outString;
    }
docs: Makes a string xml-safe, converting &amp;&lt;&gt;"' to their &amp;token; equivalents, and converting all
  other non-safe chars to their &amp;#000; version.