String concatenation in Transact-SQL

Many articles show how to concatenate rowset in single string using FOR XML PATH('') as follows:

    SELECT ProductName + ','
    FROM Northwind.dbo.Products
    FOR XML PATH('');

The problem here is that XML entities can appear in the result string. If you have "Head & Shoulders" in list of products, you will find "Head & Shoulders" in the resulting string. The following code performs correct concatenation:

    DECLARE @iXml xml;

    SELECT @iXml = (
      SELECT ProductName + ','
      FROM Northwind.dbo.Products
      FOR XML PATH);

    SELECT @iXml.value('.','nvarchar(max)');