If it was just single quotes, one could come up with a generic solution that works well in most circumstances.

s/(?<!=)'(?![ >])/&apos;/g
[download]

However, & is allowed in Windows file names, and that's much trickier to handle generally. Since only one field is likely to hold incorrect data, this problem can be handled easily.

use HTML::Entities qw( encode_entities_numeric );

s/(?<=<app text=')(.*?)(?=' date)/encode_entities_numeric("$1")/eg;
[download]