Cleaning/sanitizing xpath attributes

<?php
function xPathQuery($attr) {
    $xml = simplexml_load_file('example.xml');
    return $xml->xpath("//myElement[@content='{$attr}']");
}

xPathQuery('This should work fine');
# //myElement[@content='This should work fine']

xPathQuery('As should "this"');
# //myElement[@content='As should "this"']

xPathQuery('This'll cause problems');
# //myElement[@content='This'll cause problems']

xPathQuery('']/../privateElement[@content='private data');
# //myElement[@content='']/../privateElement[@content='private data']

>>> from lxml import etree
>>> n = etree.fromstring('<n a='He said "I&apos;m here"'/>')
>>> n.xpath("@a=$maybeunsafe", maybeunsafe='He said "I'm here"')
True

def safe_xpath_string(strvar):
    if "'" in strvar:
        return "',"'",'".join(strvar.split("'")).join(("concat('","')"))
    return strvar.join("''")

>>> print safe_xpath_string("basic")
'basic'
>>> print safe_xpath_string('He said "I'm here"')
concat('He said "I',"'",'m here"')

function xPathQuery($attr) {
    $xml = simplexml_load_file('example.xml');
    $to_encode = array('&', '"');
    $to_replace = array('&','"');
    $attr = replace($to_encode, $to_replace, $attr);
    return $xml->xpath("//myElement[@content="{$attr}"]");
}