diff --git a/include/miniocpp/utils.h b/include/miniocpp/utils.h
index a46ea24..a354e0a 100644
--- a/include/miniocpp/utils.h
+++ b/include/miniocpp/utils.h
@@ -95,6 +95,9 @@ std::string Join(const std::vector<std::string>& values,
 // EncodePath does URL encoding of path. It also normalizes multiple slashes.
 std::string EncodePath(const std::string& path);
 
+// XMLEncode does XML encoding of value.
+std::string XMLEncode(const std::string& value);
+
 // Sha256hash computes SHA-256 of data and return hash as hex encoded value.
 std::string Sha256Hash(std::string_view str);
 
diff --git a/src/baseclient.cc b/src/baseclient.cc
index fce46c9..0b46aa4 100644
--- a/src/baseclient.cc
+++ b/src/baseclient.cc
@@ -1459,7 +1459,7 @@ RemoveObjectsResponse BaseClient::RemoveObjects(RemoveObjectsApiArgs args) {
   if (args.quiet) ss << "<Quiet>true</Quiet>";
   for (auto& object : args.objects) {
     ss << "<Object>";
-    ss << "<Key>" << object.name << "</Key>";
+    ss << "<Key>" << utils::XMLEncode(object.name) << "</Key>";
     if (!object.version_id.empty()) {
       ss << "<VersionId>" << object.version_id << "</VersionId>";
     }
diff --git a/src/utils.cc b/src/utils.cc
index 6f16a66..70b62bd 100644
--- a/src/utils.cc
+++ b/src/utils.cc
@@ -56,6 +56,7 @@
 #include <map>
 #include <memory>
 #include <ostream>
+#include <pugixml.hpp>
 #include <regex>
 #include <sstream>
 #include <streambuf>
@@ -222,6 +223,14 @@ std::string EncodePath(const std::string& path) {
   return out;
 }
 
+std::string XMLEncode(const std::string& value) {
+  pugi::xml_document doc;
+  doc.append_child(pugi::node_pcdata).set_value(value);
+  std::ostringstream out;
+  doc.print(out);
+  return out.str();
+}
+
 std::string Sha256Hash(std::string_view str) {
   EVP_MD_CTX* ctx = EVP_MD_CTX_create();
   if (ctx == nullptr) {