If you use a < or a > in an XML field (e.g. as part of your password), the values must be encoded.
Is there a PHP function for this? What values need fixing?
http://stackoverflow.com/questions/2822774/php-is-htmlentities-sufficient-for-creating-xml-safe-values
http://msdn.microsoft.com/en-us/library/wkc3acws(VS.71).aspx
I've gone for this: htmlspecialchars($string,ENT_NOQUOTES)