Nice, but why not use $1 instead, and thus avoid the "evil variable" $& ?

s/(.)/sprintf('&#%03d;', ord($1))/ge;
[download]

Frankly, because it's a one-liner working on one string. The performance difference isn't going to make up for typing extra parentheses, though it is something that people should be aware of. I could have left out more parens, but I thought it would make a hard-to-read answer.

perl -pe 's/./sprintf"&#%03d;",ord$&/ge'
[download]

---

Caution: Contents may have been coded under pressure.