honestly who still uses xml as data protocol?

app.py

from flask import Flask, request, jsonify

app = Flask(__name__)


@app.route("/", methods=['POST'])
def foo():
    return jsonify([*request.form.keys()])

test_server.sh

# have flask installed
$ FLASK_APP=app.py
$ flask run &
$ curl -X POST -H 'application/xml; charset=utf-8' -d 'foo=<data content="bar">' http://127.0.0.1:5000/
["foo"]
# good so far
$ curl -X POST -H 'application/xml; charset=utf-8' -d 'foo=<data content="bar & baz">' http://127.0.0.1:5000/
["foo"," baz\">"]
# as expected...
$ curl -X POST -H 'application/xml; charset=utf-8' -d 'foo=<data content="bar &amp; baz">' http://127.0.0.1:5000/
["foo","amp; baz\">"]
# ._.