I believe you also need to encode at least &, <, and >. You can do this with a simple s///g or with something like HTML::Entities (part of HTML-Parser).