9 | 9 | I notice also we recently added some clean-up of directly-occurring control characters to `wp_kses_no_null()` as part of #28506. This strips, rather than escapes the characters, however and does not deal with many of the other UTF-8 characters that are not valid in XML. That might be slightly harder to address, given there appears to be some confusion over exactly what character encoding is being used in all situations (is using `blog_charset` sufficient?) as well as availability of PHP support for UTF-8. |