Such things probably come from 8-bit but not encoding-aware databases and are garbage to begin with.  XML 1.1 was intended to make this easier to handle at a high level by not inducing a low-level failure, but we all know what happened to that effort on the road paved with (my) good intentions.

So use a little custom code to flush such control characters.  AFAIK, neither JSON renderers nor XML parsers have such options built in.