my @tokens;

while ($sandboxxml =~ /<!\[(CDATA)\[|<!--/) {
    if ($1) { # We're in a CDATA block
        $sandboxxml =~ s/<!\[CDATA\[(.*?)\]\]>/'<<' . (0+@tokens) . '>>'/es;
        push @tokens, $1;
    } else { # Comment
        $sandboxxml =~ s/<!--.*?-->//s;
    }
}