Please describe the problem:
Enter command: xmlstarlet esc "<&\"'>"
Expect results: &lt;&amp;&quot;&apos;&gt;
Actual results: &lt;&amp;"'&gt;

Steps to reproduce:
Enter command: xmlstarlet esc "<&\"'>"

Actual results:
Results: &lt;&amp;"'&gt;

Expected results:
Expect: &lt;&amp;&quot;&apos;&gt; 

Does this happen every time?
yes

Other information:
The source file xml_escape.c in the xml_starlet path calls xmlEncodeEntitiesReentrant() in libxml2-2.6.23:entities.c.  Here is the code snippet that is possibly broken:

/*
	 * By default one have to encode at least '<', '>', '"' and '&' !
	 */
	if (*cur == '<') {
	    *out++ = '&';
	    *out++ = 'l';
	    *out++ = 't';
	    *out++ = ';';
	} else if (*cur == '>') {
	    *out++ = '&';
	    *out++ = 'g';
	    *out++ = 't';
	    *out++ = ';';
	} else if (*cur == '&') {
	    *out++ = '&';
	    *out++ = 'a';
	    *out++ = 'm';
	    *out++ = 'p';
	    *out++ = ';';
	} else if (((*cur >= 0x20) && (*cur < 0x80)) ||
	    (*cur == '\n') || (*cur == '\t') || ((html) && (*cur == '\r'))) {
	    /*
	     * default case, just copy !
	     */
	    *out++ = *cur;
	}

The double quote and apostrophe are not singled out and are thus just copied to the output stream ...