Escape all the values when appending them to the Entity Caps verification str. xmlnode_get_attrib and xmlnode_get_data unescape what they return. Thanks to Tobias and Waqas. This will still fail to validate if the other side uses entity codes (or uses other entities unnecessarily), but that should be dealt with as a hash failure instead of a collision. (10:12:11) Tobias: [18:48:43] <waqas> <identity category='client' type='pc' name='SomeClient'/><feature var='http://jabber.org/protocol/muc'/> turns into 'client/pc//SomeClient<http://jabber.org/protocol/caps<' but so does <identity category='client' type='pc' name='SomeClient&lt;http://jabber.org/protocol/caps'/>, which is a collision, right?