What book called them "illegal" <g>?

They're not. They're control or markup characters, so they have to be replaced by entity references. And, yup, that's the whole set of control/markup characters.

In fact only two of them are not allowed entirely in their simple state (ampersand and left angle). I guess those two could be considered "illegal" <g>. You can use the right angle if you want, most people do not because it's too hard to remember which is which <g>. And apos and quot are escape-able (IOW XML defines these entity references) mainly so you can use both delimiters within the text of an attribute, which itself has to be delimited.

There are some other restrictions beyond control characters. For example I think it *is* illegal according to the standard to use the nodename or namespace prefix xml, that's reserved (I may be remembering this wrong, and of course the standard didn't stop MS from creating 'XML islands' .)

There are also ranges of characters in Unicode that are discouraged for use in XML because they have special (control character) meaning to Unicode. Other than that, hex or decimal representation of all characters is supposed to be allowed.

>L<