It all depends on the result you want.

If you want to get HTML entities (é as é, etc.) then it makes sense to use HTML::Entities.

If you want to escape only &, <, >, ", and ', then you can use XML::Parser::Expat::xml_escape, but frankly it doesn't make much sense to do that.

If you want to escape those characters and also to turn all characters outside of the 0-127 range into XML character entities (i.e. &#nnn;), then you can use the following subroutine, lifted from XML::DOM and not tested with all the possible system/Perl/XML-parser combinations:

sub safe_encode
{
    my $str = shift;
    $str =~ s{
        ([\xC0-\xDF].|[\xE0-\xEF]..|[\xF0-\xFF]...)
    }{
        XmlUtf8Decode($1)
    }xegs;
    $str
}

sub XmlUtf8Decode
{
    my( $str, $hex ) = @_;
    my $len = length $str;
    my $n;

    if ( $len == 4 )
    {
        my @n = unpack "C4", $str;
        $n = (($n[0] & 0x0f) << 18) + (($n[1] & 0x3f) << 12) + (($n[2]
+ & 0x3f) << 6) + ($n[3] & 0x3f);
    }
    elsif ( $len == 3 )
    {
        my @n = unpack "C3", $str;
        $n = (($n[0] & 0x1f) << 12) + (($n[1] & 0x3f) << 6) + ($n[2] &
+ 0x3f);
    }
    elsif ( $len == 2 )
    {
        my @n = unpack "C2", $str;
    $n = (($n[0] & 0x3f) << 6) + ($n[1] & 0x3f);
    }
    elsif ( $len == 1 )
    {
        $n = ord $str;
    }
    else
    {
        die "bad value '$str' for XmlUtf8Decode";
    }

    $hex ? sprintf( "&#x%x;", $n ) : "&#$n;"
}
[download]