How to make a printf statement XML compatible?

stormblast

This:

$result = mysql_query("SELECT * FROM produkte ORDER BY postID DESC LIMIT 10");
if (!result) {
echo "An error occured";
 } else {
        echo "<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n\n";
	echo "<!DOCTYPE rss PUBLIC \"-//Netscape Communications//DTD RSS 0.91//EN\"\n";
	echo " \"http://my.netscape.com/publish/formats/rss-0.91.dtd\">\n\n";
        echo "<rss version=\"0.91\">\n\n";
	echo "<channel>\n";
        echo "<title>Die letzten Musiker-Reviews</title>\n";
        echo "<link>[url]http://www.example.de/com/portal.php[/url]</link>\n";
        echo "<description>Musiker Review Seite</description>\n";
	echo "<language>German</language>\n\n";
        while($row = mysql_fetch_assoc($result)) {
		$output = printf('<a href="index.php?ANr=%s&URL=%s&HS=%s&PN=%s">%s %s</a>', $row['artikel'], $row['url'], $row['hersteller'], $row['produkt'], $row['hersteller'], $row['produkt']);
	        echo "<item>\n";
            echo "<title>".htmlspecialchars($output)."</title>\n";
            echo "</item>\n\n";
        }
	echo "</channel>\n";
        echo "</rss>";
    }

results into:

XML Parsing Error: not well-formed
Location: http://www.example.de/com/backend.php
Line Number 14, Column 37:<a href="index.php?ANr=395534171&URL=http://www.example.de/ProduX/Gitarren/EGitarren/Stagg_S350_H.htm&HS=Stagg&PN=S-350 H">Stagg S-350 H</a><item>
------------------------------------^

So XML complains about the printf statement not about the htmlspecialchars($output). How can I make that printf XML compatible?

Thanks!

Weedpacket

It's the & in the query string. It should be &amp; - so in a way it is htmlspecialchars() - or, rather, a lack thereof.
That's why it's pointing to the = character. After reading &URL it was expecting either another letter or a semicolon.