Not to mention '& amp' etc

Which brings up another major bug: you're decoding entities you shouldn't. &, among others.

I don't have any control over the generation. It's done for me, so I can't do it any other way

I know. That's not relevant to anything I said. Unless you know the generator behaves in the specified ways, *your* code has the specified bugs.