diff --git a/feed.php b/feed.php
index 40697b6..a2d51b9 100644
--- a/feed.php
+++ b/feed.php
@@ -36,19 +36,30 @@ echo '<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom=
       echo '<guid>http://xxx.org.za/</guid>'."\n";
       echo '</item>'."\n";
 
+/*
+ * Text for an XML element: decode any HTML entities (&hellip; is not an
+ * XML entity), drop characters XML does not allow, then escape.
+ */
+function xml_text($string) {
+  $string = mb_scrub(html_entity_decode_full((string)$string), 'UTF-8');
+  $string = preg_replace('/[^\x{9}\x{A}\x{D}\x{20}-\x{D7FF}\x{E000}-\x{FFFD}\x{10000}-\x{10FFFF}]/u', '', $string);
+  return htmlspecialchars((string)$string, ENT_XML1 | ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+}
+
 $result = get_query();
 
 foreach ($result as $entry) {
+    $id = (int)$entry['id'];
     echo '<item>'."\n";
-    echo '<title>'.$entry['title'].'</title>'."\n";
-    echo '<link>http://xxx.org.za/article?id='.$entry['id'].'</link>'."\n";
+    echo '<title>'.xml_text($entry['title']).'</title>'."\n";
+    echo '<link>http://xxx.org.za/article?id='.$id.'</link>'."\n";
     echo '<pubDate>'.date("D, d M Y H:i:s O", strtotime($entry['date'])).'</pubDate>'."\n";
     if ($entry['img']) 
-      echo '<description>Image: '.$entry['title'].'</description>'."\n";
+      echo '<description>Image: '.xml_text($entry['title']).'</description>'."\n";
     else
-      echo '<description>'.strip_tags(html_entity_decode_full($entry['story'])).'</description>'."\n";
-    echo '<dc:creator>'.$entry['author'].'</dc:creator>'."\n";
-    echo '<guid>http://xxx.org.za/article?id='.$entry['id'].'</guid>'."\n";
+      echo '<description>'.xml_text(strip_tags($entry['story'])).'</description>'."\n";
+    echo '<dc:creator>'.xml_text($entry['author']).'</dc:creator>'."\n";
+    echo '<guid>http://xxx.org.za/article?id='.$id.'</guid>'."\n";
     echo '</item>'."\n";
 }