create or replace function dba.xml_encode(pInput long nvarchar) returns xml
begin // assumes nvarchar is defined as utf-8
  declare @path long varchar;
  declare @nextPos integer;
  declare @intCode smallint;
  declare @nextCode bigint;
  declare @numPoints smallint;
  declare @subPos integer;

  // note: i am making up the "&pct;" entity to move %s out of the way, patched up in the return at the end
  set @path = replace(replace(replace(replace(replace(replace(replace(http_encode(pInput),
    '%26','&'),'%3C','<'),'%3E','>'),'%27','''),'%22','"'),
    '%1A','�'),'%25','&pct;');

  // first pass: legitimate character encodings
  set @nextPos = locate(@path, '%');
  while @nextPos <> 0 loop
    set @intCode = hextoint(substring(@path, @nextPos+1, 2));
    set @numPoints = 1;
    set @nextCode = @intCode;
    case
      when @intCode >= 0xF0 then
        set @numPoints = 4;
        set @nextCode = @intCode & 0x07;
      when @intCode >= 0xE0 then
        set @numPoints = 3;
        set @nextCode = @intCode & 0x0F;
      when @intCode >= 0xD0 then
        set @numPoints = 2;
        set @nextCode = @intCode & 0x1F;
      when @intCode >= 0x80 then
        set @numPoints = 0;   // error
    end case;
    case @numPoints
      when 0 then
        set @nextPos = @nextPos + 1; // skip
      when 1 then
        set @path = replace(@path, substring(@path, @nextPos, 3), char(@intCode));
      else
        set @subPos = @nextPos + 3;
        subLoop: while @numPoints > 1 and substring(@path, @subPos, 1) = '%' loop
          set @intCode = hextoint(substring(@path, @subPos+1, 2));
          if @intCode & 0xC0 <> 0x80 then
            leave subLoop;
          end if;
          set @nextCode = (@nextCode * 64) | (@intCode & 0x3F);
          set @numPoints = @numPoints - 1;
          set @subPos = @subPos + 3;
        end loop;
        if @numPoints > 1 then
          set @nextPos = @subPos + 1; // error
        else
          set @path = replace(@path, substring(@path, @nextPos, @subPos-@nextPos),
            '&#' || @nextCode || ';');
        end if;
    end case;
    set @nextPos = locate(@path, '%', @nextPos);
  end loop;

  // second pass: corrupted character encodings
  set @nextPos = locate(@path, '%');
  while @nextPos <> 0 loop
    set @intCode = hextoint(substring(@path, @nextPos+1, 2));
    set @path = replace(@path, substring(@path, @nextPos, 3), '&#' || @intCode || ';');
    set @nextPos = locate(@path, '%', @nextPos);
  end loop;

  return replace(@path,'&pct;','%');
end;