public static boolean hasIllegalCharacterReferences(String string) {
        int needle = 0;
        while (needle < string.length()) {
            final int start = string.indexOf("&#", needle);
            if (start == -1) {
                return false;
            }
            final int end = string.indexOf(";", start + 2);
            if (end == -1) {
                return false;
            }
            needle = end;

            final boolean isHex = string.charAt(start + 2) == 'x' || string.charAt(start + 2) == 'X';

            final String candidate;
            final int radix;
            if (isHex) {
                candidate = string.substring(start + 3, end);
                radix = 16;
            } else {
                candidate = string.substring(start + 2, end);
                radix = 10;
            }

            try {
                final int value = Integer.parseInt(candidate, radix);
                if (!isLegalXmlCharacter(value)) {
                    return true;
                }
            } catch (NumberFormatException e) {
                // The 'candidate' value wasn't a numeric character reference.
            }
        }

        return false;
    }
This method verifies if the provided argument contains at least one numeric character reference (
<code>CharRef	   ::=   	'&#' [0-9]+ ';' | '&#x' [0-9a-fA-F]+ ';</code>) for which the decimal or hexadecimal
character value refers to an invalid XML 1.0 character.

@param string
           The input string
@return {@code true} if the input string contains an invalid numeric character reference, {@code false}
        otherwise.
@see <a href="https://www.w3.org/TR/2008/REC-xml-20081126/#dt-charref">Definition of a character reference</a>
xmppserver/src/main/java/org/jivesoftware/openfire/nio/XMLLightweightParser.java