--- java/org/apache/jasper/compiler/ELParser.java	(revision 1590742)
+++ java/org/apache/jasper/compiler/ELParser.java	(working copy)
@@ -255,7 +255,7 @@ 
      *
      * @return The escaped version of the input
      */
-    private static String escapeLiteralExpression(String input,
+    static String escapeLiteralExpression(String input,
             boolean isDeferredSyntaxAllowedAsLiteral) {
         int len = input.length();
         int lastAppend = 0;
@@ -552,9 +552,9 @@ 
     }
 
 
-    protected static class TextBuilder extends ELNode.Visitor {
+    static class TextBuilder extends ELNode.Visitor {
 
-        private final boolean isDeferredSyntaxAllowedAsLiteral;
+        protected final boolean isDeferredSyntaxAllowedAsLiteral;
         protected StringBuilder output = new StringBuilder();
 
         protected TextBuilder(boolean isDeferredSyntaxAllowedAsLiteral) {
--- java/org/apache/jasper/compiler/Validator.java	(revision 1590742)
+++ java/org/apache/jasper/compiler/Validator.java	(working copy)
@@ -1448,7 +1448,9 @@ 
 
             @Override
             public void visit(Text n) throws JasperException {
-                output.append(xmlEscape(n.getText()));
+                output.append(ELParser.escapeLiteralExpression(
+                        xmlEscape(n.getText()),
+                        isDeferredSyntaxAllowedAsLiteral));
             }
         }
 
--- test/org/apache/jasper/compiler/TestParser.java	(revision 1590742)
+++ test/org/apache/jasper/compiler/TestParser.java	(working copy)
@@ -412,6 +412,9 @@ 
         Assert.assertTrue(result, result.contains("<set data-value=\"03b\\\\x\\?resize03b\"/>"));
         Assert.assertTrue(result, result.contains("<04a\\?resize04a/>"));
         Assert.assertTrue(result, result.contains("<04b\\\\x\\?resize04b/>"));
+        Assert.assertTrue(result, result.contains("<set data-value=\"05a$${&amp;\"/>"));
+        Assert.assertTrue(result, result.contains("<set data-value=\"05b$${&amp;2\"/>"));
+        Assert.assertTrue(result, result.contains("<set data-value=\"05c##{&gt;hello&lt;\"/>"));
     }
 
     /** Assertion for text printed by tags:echo */
--- test/webapp/bug5nnnn/bug56334.jspx	(revision 1590742)
+++ test/webapp/bug5nnnn/bug56334.jspx	(working copy)
@@ -29,4 +29,9 @@ 
 
     <jsp:element name="04b\\x${'\\?resize04b'}"></jsp:element>
 
+    <!-- Test 5: Use \$, \# in template text -->
+    <set data-value="05a\$\${&amp;" />
+    <set data-value="05b\$\${&amp;${1+1}" />
+    <set data-value="05c\#\#{&gt;${'hello'}&lt;" />
+
 </jsp:root>