How to handle string data characters that are illegal in XML?

Question

Consider this web service implemented in Java:

@WebMethod(operationName = "test1")
@WebResult(name = "test1", targetNamespace = "http://test.example.org/")
public String test1()
{
    return "foo\u0000bar"; // "foo" + NUL + "bar"
}

Using (versions 2.5.10 and 2.7.18 of) apache CXF, this will return (SOAP envelope omitted):

<ns2:test1>foo[NULL byte here]bar</ns2:test1>

Which is invalid XML.

Do other web service libraries handle the NULL (and other characters that are invalid in XML) differently? What is the correct standard handling?

Answer 1

The ideal is to have some XML mechanism for whatever the control character is meant to do.

If that isn't possible, or if you need to send non-characters for some reason (almost always a sign of a very bad idea, but you might have to deal with someone else's bad idea) then it's best sent as base-64 encoded or some other way of wrapping non-textual data in text.