> It's safest to treat > as special too, because of the bare possibility
> of ]]> in character content.
Only if they have the CDATA start, right?
> And of course attribute values need ' or ".
Only if the attribute value needs both quotes, which I put into the
not-often category.
/r$
--
Rich Salz Chief Security Architect
DataPower Technology http://www.datapower.com
XS40 XML Security Gateway http://www.datapower.com/products/xs40.html
XML Security Overview http://www.datapower.com/xmldev/xmlsecurity.html
