I think you want a character class which excludes the ones you don't want, with a quantifier.

my $allowed = qr/^[^<>"&]{8,12}$/;
[download]

The end anchors enforce length and exclusion of the forbidden characters.

You mention XML. There are lots of CPAN modules dealing with XML. One of them may help with the larger picture of whatever you're trying to do.