diff --git a/lib/common/tests/xml/Makefile.am b/lib/common/tests/xml/Makefile.am
index da8aecd31d..9fe14d1407 100644
--- a/lib/common/tests/xml/Makefile.am
+++ b/lib/common/tests/xml/Makefile.am
@@ -1,19 +1,20 @@
 #
 # Copyright 2022-2024 the Pacemaker project contributors
 #
 # The version control history for this file may have further details.
 #
 # This source code is licensed under the GNU General Public License version 2
 # or later (GPLv2+) WITHOUT ANY WARRANTY.
 #
 
 include $(top_srcdir)/mk/tap.mk
 include $(top_srcdir)/mk/unittest.mk
 
 # Add "_test" to the end of all test program names to simplify .gitignore.
 check_PROGRAMS = crm_xml_init_test 		\
 		 pcmk__xe_foreach_child_test 	\
 		 pcmk__xe_match_test		\
-		 pcmk__xml_escape_test
+		 pcmk__xml_escape_test		\
+		 pcmk__xml_needs_escape_test
 
 TESTS = $(check_PROGRAMS)
diff --git a/lib/common/tests/xml/pcmk__xml_needs_escape_test.c b/lib/common/tests/xml/pcmk__xml_needs_escape_test.c
new file mode 100644
index 0000000000..79cbd0d4a4
--- /dev/null
+++ b/lib/common/tests/xml/pcmk__xml_needs_escape_test.c
@@ -0,0 +1,146 @@
+/*
+ * Copyright 2024 the Pacemaker project contributors
+ *
+ * The version control history for this file may have further details.
+ *
+ * This source code is licensed under the GNU General Public License version 2
+ * or later (GPLv2+) WITHOUT ANY WARRANTY.
+ */
+
+#include <crm_internal.h>
+
+#include <crm/common/unittest_internal.h>
+#include <crm/common/xml_internal.h>
+
+// @TODO Add tests for Unicode characters
+
+static void
+null_empty(void **state)
+{
+    assert_false(pcmk__xml_needs_escape(NULL, false));
+    assert_false(pcmk__xml_needs_escape(NULL, true));
+
+    assert_false(pcmk__xml_needs_escape("", false));
+    assert_false(pcmk__xml_needs_escape("", true));
+}
+
+static void
+escape_unchanged(void **state)
+{
+    // No escaped characters (note: this string includes single quote at end)
+    const char *unchanged = "abcdefghijklmnopqrstuvwxyz"
+                            "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+                            "0123456789"
+                            "\n\t`~!@#$%^*()-_=+/|\\[]{}?.,'";
+
+    assert_false(pcmk__xml_needs_escape(unchanged, false));
+    assert_false(pcmk__xml_needs_escape(unchanged, true));
+}
+
+// Ensure special characters get escaped at start, middle, and end
+
+static void
+escape_left_angle(void **state)
+{
+    const char *l_angle_left = "<abcdef";
+    const char *l_angle_mid = "abc<def";
+    const char *l_angle_right = "abcdef<";
+
+    assert_true(pcmk__xml_needs_escape(l_angle_left, false));
+    assert_true(pcmk__xml_needs_escape(l_angle_mid, false));
+    assert_true(pcmk__xml_needs_escape(l_angle_right, false));
+
+    assert_true(pcmk__xml_needs_escape(l_angle_left, true));
+    assert_true(pcmk__xml_needs_escape(l_angle_mid, true));
+    assert_true(pcmk__xml_needs_escape(l_angle_right, true));
+}
+
+static void
+escape_right_angle(void **state)
+{
+    const char *r_angle_left = ">abcdef";
+    const char *r_angle_mid = "abc>def";
+    const char *r_angle_right = "abcdef>";
+
+    assert_true(pcmk__xml_needs_escape(r_angle_left, false));
+    assert_true(pcmk__xml_needs_escape(r_angle_mid, false));
+    assert_true(pcmk__xml_needs_escape(r_angle_right, false));
+
+    assert_true(pcmk__xml_needs_escape(r_angle_left, true));
+    assert_true(pcmk__xml_needs_escape(r_angle_mid, true));
+    assert_true(pcmk__xml_needs_escape(r_angle_right, true));
+}
+
+static void
+escape_ampersand(void **state)
+{
+    const char *ampersand_left = "&abcdef";
+    const char *ampersand_mid = "abc&def";
+    const char *ampersand_right = "abcdef&";
+
+    assert_true(pcmk__xml_needs_escape(ampersand_left, false));
+    assert_true(pcmk__xml_needs_escape(ampersand_mid, false));
+    assert_true(pcmk__xml_needs_escape(ampersand_right, false));
+
+    assert_true(pcmk__xml_needs_escape(ampersand_left, true));
+    assert_true(pcmk__xml_needs_escape(ampersand_mid, true));
+    assert_true(pcmk__xml_needs_escape(ampersand_right, true));
+}
+
+static void
+escape_double_quote(void **state)
+{
+    const char *double_quote_left = "\"abcdef";
+    const char *double_quote_mid = "abc\"def";
+    const char *double_quote_right = "abcdef\"";
+
+    assert_false(pcmk__xml_needs_escape(double_quote_left, false));
+    assert_false(pcmk__xml_needs_escape(double_quote_mid, false));
+    assert_false(pcmk__xml_needs_escape(double_quote_right, false));
+
+    assert_true(pcmk__xml_needs_escape(double_quote_left, true));
+    assert_true(pcmk__xml_needs_escape(double_quote_mid, true));
+    assert_true(pcmk__xml_needs_escape(double_quote_right, true));
+}
+
+static void
+escape_nonprinting(void **state)
+{
+    const char *alert_left = "\aabcdef";
+    const char *alert_mid = "abc\adef";
+    const char *alert_right = "abcdef\a";
+
+    const char *delete_left = "\x7f""abcdef";
+    const char *delete_mid = "abc\x7f""def";
+    const char *delete_right = "abcdef\x7f";
+
+    const char *nonprinting_all = "\a\r\x7f\x1b";
+
+    assert_true(pcmk__xml_needs_escape(alert_left, false));
+    assert_true(pcmk__xml_needs_escape(alert_mid, false));
+    assert_true(pcmk__xml_needs_escape(alert_right, false));
+
+    assert_true(pcmk__xml_needs_escape(alert_left, true));
+    assert_true(pcmk__xml_needs_escape(alert_mid, true));
+    assert_true(pcmk__xml_needs_escape(alert_right, true));
+
+    assert_true(pcmk__xml_needs_escape(delete_left, false));
+    assert_true(pcmk__xml_needs_escape(delete_mid, false));
+    assert_true(pcmk__xml_needs_escape(delete_right, false));
+
+    assert_true(pcmk__xml_needs_escape(delete_left, true));
+    assert_true(pcmk__xml_needs_escape(delete_mid, true));
+    assert_true(pcmk__xml_needs_escape(delete_right, true));
+
+    assert_true(pcmk__xml_needs_escape(nonprinting_all, false));
+    assert_true(pcmk__xml_needs_escape(nonprinting_all, true));
+}
+
+PCMK__UNIT_TEST(NULL, NULL,
+                cmocka_unit_test(null_empty),
+                cmocka_unit_test(escape_unchanged),
+                cmocka_unit_test(escape_left_angle),
+                cmocka_unit_test(escape_right_angle),
+                cmocka_unit_test(escape_ampersand),
+                cmocka_unit_test(escape_double_quote),
+                cmocka_unit_test(escape_nonprinting));