import re

ILLEGAL_XML_CHARS_RE = re.compile(
    '['
    # Control characters; newline (\x0A and \x0D) and TAB (\x09) are legal
    '\x00-\x08\x0B\x0C\x0E-\x1F'
    # Surrogate characters
    '\uD800-\uDFFF'
    # Special Unicode characters
    '\uFFFE'
    '\uFFFF'
    # Match multiple sequential invalid characters for better efficiency
    ']+')

def sanitize(text, replace_func):
    def callback(regs):
        return replace_func(regs[0])

    return ILLEGAL_XML_CHARS_RE.sub(callback, text)

def escape(text):
    return ''.join(f'\\x{ord(char):02x}' for char in text)

invalid = '\x00'
test = f'a{invalid}b'
print(sanitize(test, lambda text: '#' * len(text)))
print(sanitize(test, escape))