Escape XML
Encode special characters into XML entities. Converts < > & " ' to their safe entity equivalents.
What is XML Escaping?
XML reserves five characters as syntax delimiters. If any of these characters appear in element text content or attribute values as literal data rather than markup, they must be replaced with their corresponding predefined entity references. Failing to escape them produces malformed XML that parsers will reject.
This tool replaces every reserved character with its entity reference, making the output safe to embed anywhere in an XML document - inside element bodies, attribute values, or as a value to be embedded in a larger XML template.
The Five Predefined XML Entities
| Character | Entity | Why it must be escaped |
|---|---|---|
| & | & | Starts all entity references; an unescaped & not followed by a valid entity name causes a parse error. |
| < | < | Opens all tags and processing instructions; a literal < in content is always interpreted as the start of a tag. |
| > | > | Closes tags; technically only required after ]] in text content, but escaping it everywhere is the safe convention. |
| " | " | Delimits double-quoted attribute values; must be escaped inside attr="..." attributes. |
| ' | ' | Delimits single-quoted attribute values; must be escaped inside attr='...' attributes. |
Common Use Cases
Embedding User Input in XML
Any time user-supplied text is written into an XML document (configuration, SOAP request, RSS feed) it must be escaped. Skipping this step is the root cause of XML injection vulnerabilities.
SOAP Request Building
SOAP message bodies often carry data that includes SQL fragments, HTML, or code snippets. Each field value must be escaped before insertion into the XML envelope to avoid breaking the message structure.
RSS & Atom Feeds
Article titles and summaries in RSS/Atom often contain ampersands (company names, URLs with query strings) and angle brackets (programming comparisons). Escaping ensures feed readers parse the XML correctly.
XML Template Injection
When building XML via string interpolation in code, escape all dynamic values first. This prevents attackers from closing your elements early and injecting arbitrary XML structure - the XML equivalent of SQL injection.
Escaping vs. CDATA Sections
An alternative to escaping individual characters is wrapping the content in a CDATA
section: <![CDATA[ your content here ]]>. Inside a CDATA section, the
parser treats everything as literal text and no escaping is needed - except for the
closing delimiter ]]> itself, which cannot appear in the content.
CDATA sections are most useful for embedding large blocks of code, HTML, or SQL where escaping every character would be tedious and unreadable. For short values like attribute content or individual field values, entity escaping is more appropriate and universally supported.