You shouldn't be passing XML through decode_entities. The result will be not be an well-formed XML document. Any & entities will be turned into & and those are must be escaped with

XML::Parser will decode entities in the XML document. The NoExpand option controls this. The standard entities will be handled automatically. If this is all you have in your document, then you don't need to worry about them.

If the XML document contains any HTML entities other than the standard three, you will need to handle those specially. The XML standard way is to declare them in a DTD either an internal DTD subset or external file. Declaring entities is one of the last uses for DTDs. Unluckily, using DTDs either in an internal subset or external file adds some complexity. There have been some proposals to handle character entities without DTDs but none of them have been accepted.