What happens if the fields in my database contain & and < as literal characters?
The ampersand character (&) and the left angle bracket (<) must be escaped using either numeric character references or the strings "&" and "<" respectively. The right angle bracket (>) may be represented using the string “>”, and must, for compatibility, be escaped using either “>” or a character reference when it appears in the string “]]>” in content, when that string is not marking the end of a CDATA section. Note that strings containing & and < may be encoded in a CDATA section (e.g. "
