Hmm. Looks like this page has a good solution: http://cse-mjmcl.cse.bris.ac.uk/blog/2007/02/14/1171465494443.html
They get the list of valid characters from the XML spec, and just iterate through the string and strip out invalid characters.
pfitzsimmons
2009-10-12 20:36:01