综上所述，文本中的有效字符为:

制表符，换行和换行。 除&和<外，所有非控制字符都有效。 如果使用]]，则>无效。

XML规范的2.2节和2.4节详细给出了答案:

字符

合法字符包括制表符、回车符、换行符以及Unicode和ISO/IEC 10646的合法字符

字符数据

The ampersand character (&) and the left angle bracket (<) must not appear in their literal form, except when used as markup delimiters, or within a comment, a processing instruction, or a CDATA section. If they are needed elsewhere, they must be escaped using either numeric character references or the strings " & " and " < " respectively. The right angle bracket (>) may be represented using the string " > ", and must, for compatibility, be escaped using either " > " or a character reference when it appears in the string " ]]> " in content, when that string is not marking the end of a CDATA section.

这是一个c#代码，用于从字符串中删除XML无效字符并返回一个新的有效字符串。

public static string CleanInvalidXmlChars(string text) 
{ 
    // From xml spec valid chars: 
    // #x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]     
    // any Unicode character, excluding the surrogate blocks, FFFE, and FFFF. 
    string re = @"[^\x09\x0A\x0D\x20-\uD7FF\uE000-\uFFFD\u10000-\u10FFFF]"; 
    return Regex.Replace(text, re, ""); 
}

对于XSL(在非常懒惰的日子里)，我使用:

capture="&(?!amp;)" capturereplace="&"

翻译所有没有遵循的&符号på amp;敬合适的人。

在某些情况下，输入是CDATA，但是使用XML的系统没有考虑到它。这是一个草率的修复，小心…

在c#中删除不正确的XML字符的另一种方法是使用XmlConvert。IsXmlChar (.NET Framework 4.0后可用)

public static string RemoveInvalidXmlChars(string content)
{
   return new string(content.Where(ch => System.Xml.XmlConvert.IsXmlChar(ch)).ToArray());
}

或者你可以检查所有字符都是xml有效的:

public static bool CheckValidXmlChars(string content)
{
   return content.All(ch => System.Xml.XmlConvert.IsXmlChar(ch));
}

net小提琴

例如，垂直制表符(\v)对于XML无效，它是有效的UTF-8，但不是有效的XML 1.0，甚至许多库(包括libxml2)都会遗漏它并无声地输出无效的XML。

在Woodstox XML处理器中，无效字符由以下代码分类:

if (c == 0) {
    throw new IOException("Invalid null character in text to output");
}
if (c < ' ' || (c >= 0x7F && c <= 0x9F)) {
    String msg = "Invalid white space character (0x" + Integer.toHexString(c) + ") in text to output";
    if (mXml11) {
        msg += " (can only be output using character entity)";
    }
    throw new IOException(msg);
}
if (c > 0x10FFFF) {
    throw new IOException("Illegal unicode character point (0x" + Integer.toHexString(c) + ") to output; max is 0x10FFFF as per RFC");
}
/*
 * Surrogate pair in non-quotable (not text or attribute value) content, and non-unicode encoding (ISO-8859-x,
 * Ascii)?
 */
if (c >= SURR1_FIRST && c <= SURR2_LAST) {
    throw new IOException("Illegal surrogate pair -- can only be output via character entities, which are not allowed in this content");
}
throw new IOException("Invalid XML character (0x"+Integer.toHexString(c)+") in text to output");

来自这里

预先声明的字符是:

& < > " '

有关更多信息，请参阅“XML中的特殊字符是什么?”