Invalid numeric character reference

What it means

A numeric reference such as © is a legal way to write a character. It is not a way to smuggle in a character XML bans: the reference is resolved and then checked against the same rules as a literal, so � fails exactly as a raw NUL would.

Teams often reach for this escape after hitting the raw control-character error, which is why the two usually appear in that order. Neither has an escaping fix — the character has to go.

What usually causes it

• An attempt to escape a control character that was already rejected as a literal.
• A NUL from a fixed-width or C-string field encoded as � on the way out.
• An off-by-one in a code-point calculation producing 0, or a value above U+10FFFF.
• A lone surrogate (U+D800–U+DFFF) written as a reference after a bad UTF-16 conversion.

How to fix it

• Remove the character. XML 1.0 has no legal representation for it, escaped or not.
• Base64-encode the field if the byte is meaningful rather than accidental.
• Validate code points against the XML Char production before emitting a reference.
• Fix surrogate handling upstream: pair them into a single code point, then emit that.

The same error elsewhere

Different parsers, same defect. If you arrived with one of these messages, you are in the right place.

• Xerces (Java)

  Character reference "&#x0" is an invalid XML character.

• expat (Python)

  reference to invalid character number: line 2, column 6

• .NET System.Xml

  '', hexadecimal value 0x00, is an invalid character.