...
JAXBContext ctx = ...
Marshaller m = ctx.createMarshaller();
m.setProperty(MarshallerProperties.CHARACTER_ESCAPE_HANDLER, new MyHandler());
...

m.setProperty("com.sun.xml.bind.marshaller.CharacterEscapeHandler", new MyHandler());
m.setProperty("com.sun.xml.internal.bind.marshaller.CharacterEscapeHandler", new MyHandler());

package example;
 
import java.io.IOException;
import java.io.Writer;
 
import org.eclipse.persistence.oxm.CharacterEscapeHandler;
 
public class MyHandler implements CharacterEscapeHandler {
 
    /**
     * Escape characters inside the buffer and send the output to the Writer.
     * 
     * @exception IOException
     *                In an error condition, IOException can be thrown to stop
     *                the marshalling process.
     */
    public void escape(char[] buf, int start, int len, boolean isAttValue, Writer out) throws IOException {
        for (int i = start; i < start + len; i++) {
            char ch = buf[i];
 
            if (ch == '&') {
                out.write("&amp;");
                continue;
            }
 
            if (ch == '"' && isAttValue) {
                out.write("&quot;");
                continue;
            }
            if (ch == '\'' && isAttValue) {
                out.write("&apos;");
                continue;
            }
 
            // you should handle other characters like < or >
            // ...
 
            if (ch > 0x7F) {
                // escape everything above ASCII to &#xXXXX;
                out.write("&#x");
                out.write(Integer.toHexString(ch));
                out.write(";");
                continue;
            }
 
            // otherwise print normally
            out.write(ch);
        }
    }
}