* - Tab (0x9)
     * - Line feed (0xA)
     * - Carriage return (0xD)
     * - Any character between 0x20 and 0xD7FF
     * - Any character between 0xE000 and 0xFFFD
     * - Any character between 0x10000 and 0x10FFFF
     *
     * @param in the input string to be processed
     * @return a new string with invalid XML characters removed, or the original
     *         string if it is empty
     */

0 and 255 inclusive.  Hexadecimal escapes satisfy this condition
by construction. The escapes <code>\u</code> and <code>\U</code>
represent Unicode code points so within them some values are illegal,
in particular those above <code>0x10FFFF</code> and surrogate halves.
</p>

<p>
After a backslash, certain single-character escapes represent special values:
</p>

<pre class="grammar">
\a   U+0007 alert or bell
\b   U+0008 backspace