<?xml version=\x221.0\x22 encoding=\x22utf-8\x22?>\x0A<order id=\x22test\x22 affiliate=\x22main\x22 event_id=\x221\x22 ref=\x22TPCYA\x22 alias=\x22\x22/>
 

    $str = "<?xml version=\x221.0\x22 encoding=\x22utf-8\x22?>\x0A<order id=\x22test\x22 affiliate=\x22main\x22 event_id=\x221\x22 ref=\x22TPCYA\x22 alias=\x22\x22/>";

    function hexdec_string($content) {
        preg_replace_callback(
            "(\\\\x([0-9a-f]{2}))i",
            function($matches) {return chr(hexdec($matches[1]));},
            // $string
            $content
        );  

        return $content;
    }

    echo htmlspecialchars(hexdec_string($str), ENT_QUOTES); //将 xml的内容作为纯文本输出

<?xml version="1.0" encoding="utf-8"?> <order id="test" affiliate="main" event_id="1" ref="TPCYA" alias=""/>