Index: dojo-release-1.3.2-src/dojox/xmpp/RosterService.js
===================================================================
--- dojo-release-1.3.2-src.orig/dojox/xmpp/RosterService.js	2009-09-04 11:21:12.000000000 -0700
+++ dojo-release-1.3.2-src/dojox/xmpp/RosterService.js	2009-09-04 11:22:38.000000000 -0700
@@ -84,7 +84,7 @@
 		if (newGroups){
 			for (var x=0;x<newGroups.length;x++){
 				request.append("<group>");
-				request.append(newGroups[x]);
+				request.append(dojox.xmpp.util.xmlEncode(newGroups[x]));
 				request.append("</group>");
 			}
 		}
Index: dojo-release-1.3.2-src/dojox/xmpp/util.js
===================================================================
--- dojo-release-1.3.2-src.orig/dojox/xmpp/util.js	2009-09-04 11:21:12.000000000 -0700
+++ dojo-release-1.3.2-src/dojox/xmpp/util.js	2009-09-04 11:22:38.000000000 -0700
@@ -3,7 +3,7 @@
 
 dojox.xmpp.util.xmlEncode = function(str) {
 	if(str) {
-		str = str.replace("&", "&amp;").replace(">", "&gt;").replace("<", "&lt;").replace("'", "&apos;").replace('"', "&quot;");
+		str = str.replace(/\&/g, "&amp;").replace(/\>/g, "&gt;").replace(/\</g, "&lt;").replace(/\'/g, "&apos;").replace(/\"/g, "&quot;");
 	}
 	return str;
 }