XML export mangles <, >, and &

In views_bonus_export.theme.inc are these lines, starting at line 63:

    foreach ($row as $field => $content) {
      $vars['themed_rows'][$num][$field] = str_replace(
        array('&', '<', '>'),
        array('&amp;', '&lt;', '&gt;'),
        $content);
    }

A few problems.

First, there is no need to check for >. The W3C's XML spec sec. 2.4 only says to worry if it's within a CDATA section (because it could conflict with ]]>), but those were removed per 🐛 CDATA is pointless Closed: outdated .

Second, & and < should not be altered unless they are not part of "markup delimiters, or within a comment." For example, if you come across <b>, the opening < should not be altered. Also, if you come across across &, that should not be altered. Unfortunately the current code will convert the tag to <b> and the entity to &. And if either is within a comment, they should be skipped entirely.