diff -ur org.ORIG\jivesoftware\smack\packet\Authentication.java org\jivesoftware\smack\packet\Authentication.java
--- org.ORIG\jivesoftware\smack\packet\Authentication.java	Thu Oct 07 05:04:00 2004
+++ org\jivesoftware\smack\packet\Authentication.java	Thu Oct 07 23:28:18 2004
@@ -185,7 +185,7 @@
                 buf.append("<username/>");
             }
             else {
-                buf.append("<username>").append( username).append("</username>");
+                buf.append("<username>").append(StringUtils.escapeForXML(username)).append("</username>");
             }
         }
         if (digest != null) {
@@ -193,7 +193,7 @@
                 buf.append("<digest/>");
             }
             else {
-                buf.append("<digest>").append(digest).append("</digest>");
+                buf.append("<digest>").append(StringUtils.escapeForXML(digest)).append("</digest>");
             }
         }
         if (password != null && digest == null) {
@@ -201,7 +201,7 @@
                 buf.append("<password/>");
             }
             else {
-                buf.append("<password>").append(password).append("</password>");
+                buf.append("<password>").append(StringUtils.escapeForXML(password)).append("</password>");
             }
         }
         if (resource != null) {
@@ -209,7 +209,7 @@
                 buf.append("<resource/>");
             }
             else {
-                buf.append("<resource>").append(resource).append("</resource>");
+                buf.append("<resource>").append(StringUtils.escapeForXML(resource)).append("</resource>");
             }
         }
         buf.append("</query>");
diff -ur org.ORIG\jivesoftware\smack\packet\DefaultPacketExtension.java org\jivesoftware\smack\packet\DefaultPacketExtension.java
--- org.ORIG\jivesoftware\smack\packet\DefaultPacketExtension.java	Thu Oct 07 05:04:00 2004
+++ org\jivesoftware\smack\packet\DefaultPacketExtension.java	Thu Oct 07 23:29:59 2004
@@ -53,6 +53,7 @@
 package org.jivesoftware.smack.packet;
 
 import java.util.*;
+import org.jivesoftware.smack.util.StringUtils;
 
 /**
  * Default implementation of the PacketExtension interface. Unless a PacketExtensionProvider
@@ -118,7 +119,7 @@
             String name = (String)i.next();
             String value = getValue(name);
             buf.append("<").append(name).append(">");
-            buf.append(value);
+            buf.append(StringUtils.escapeForXML(value));
             buf.append("</").append(name).append(">");
         }
         buf.append("</").append(elementName).append(">");
diff -ur org.ORIG\jivesoftware\smack\packet\Registration.java org\jivesoftware\smack\packet\Registration.java
--- org.ORIG\jivesoftware\smack\packet\Registration.java	Thu Oct 07 05:04:00 2004
+++ org\jivesoftware\smack\packet\Registration.java	Thu Oct 07 23:32:31 2004
@@ -54,6 +54,7 @@
 
 import java.util.Map;
 import java.util.Iterator;
+import org.jivesoftware.smack.util.StringUtils;
 
 /**
  * Represents registration packets. An empty GET query will cause the server to return information
@@ -163,13 +164,13 @@
         StringBuffer buf = new StringBuffer();
         buf.append("<query xmlns=\"jabber:iq:register\">");
         if (username != null) {
-            buf.append("<username>").append(username).append("</username>");
+            buf.append("<username>").append(StringUtils.escapeForXML(username)).append("</username>");
         }
         if (password != null) {
-            buf.append("<password>").append(password).append("</password>");
+            buf.append("<password>").append(StringUtils.escapeForXML(password)).append("</password>");
         }
         if (instructions != null) {
-            buf.append("<instructions>").append(instructions).append("</instructions>");
+            buf.append("<instructions>").append(StringUtils.escapeForXML(instructions)).append("</instructions>");
         }
         if (attributes != null && attributes.size() > 0) {
             Iterator fieldNames = attributes.keySet().iterator();
@@ -177,7 +178,7 @@
                 String name = (String)fieldNames.next();
                 String value = (String)attributes.get(name);
                 buf.append("<").append(name).append(">");
-                buf.append(value);
+                buf.append(StringUtils.escapeForXML(value));
                 buf.append("</").append(name).append(">");
             }
         }
diff -ur org.ORIG\jivesoftware\smack\packet\RosterPacket.java org\jivesoftware\smack\packet\RosterPacket.java
--- org.ORIG\jivesoftware\smack\packet\RosterPacket.java	Thu Oct 07 05:04:00 2004
+++ org\jivesoftware\smack\packet\RosterPacket.java	Thu Oct 07 21:10:13 2004
@@ -53,6 +53,7 @@
 package org.jivesoftware.smack.packet;
 
 import java.util.*;
+import org.jivesoftware.smack.util.StringUtils;
 
 /**
  * Represents XMPP roster packets.
@@ -237,9 +238,9 @@
 
         public String toXML() {
             StringBuffer buf = new StringBuffer();
-            buf.append("<item jid=\"").append(user).append("\"");
+            buf.append("<item jid=\"").append(StringUtils.escapeForXML(user)).append("\"");
             if (name != null) {
-                buf.append(" name=\"").append(name).append("\"");
+                buf.append(" name=\"").append(StringUtils.escapeForXML(name)).append("\"");
             }
             if (itemType != null) {
                 buf.append(" subscription=\"").append(itemType).append("\"");
@@ -251,7 +252,7 @@
             synchronized (groupNames) {
                 for (int i=0; i<groupNames.size(); i++) {
                     String groupName = (String)groupNames.get(i);
-                    buf.append("<group>").append(groupName).append("</group>");
+                    buf.append("<group>").append(StringUtils.escapeForXML(groupName)).append("</group>");
                 }
             }
             buf.append("</item>");
diff -ur org.ORIG\jivesoftware\smack\packet\XMPPError.java org\jivesoftware\smack\packet\XMPPError.java
--- org.ORIG\jivesoftware\smack\packet\XMPPError.java	Thu Oct 07 05:04:00 2004
+++ org\jivesoftware\smack\packet\XMPPError.java	Thu Oct 07 23:33:44 2004
@@ -52,6 +52,8 @@
 
 package org.jivesoftware.smack.packet;
 
+import org.jivesoftware.smack.util.StringUtils;
+
 /**
  * Represents a XMPP error sub-packet. Typically, a server responds to a request that has
  * problems by sending the packet back and including an error packet. Each error has a code
@@ -132,7 +134,7 @@
         StringBuffer buf = new StringBuffer();
         buf.append("<error code=\"").append(code).append("\">");
         if (message != null) {
-            buf.append(message);
+            buf.append(StringUtils.escapeForXML(message));
         }
         buf.append("</error>");
         return buf.toString();