XML Escape/Unescape
Instantly escape or unescape XML special characters. Convert <, >, &, ", ' to XML entities (<, >, &, ", ') with real-time preview.
What characters need to be escaped in XML?
Five characters must be escaped in XML: < (less than) becomes <, > (greater than) becomes >, & (ampersand) becomes &, " (double quote) becomes ", and ' (apostrophe) becomes '.
What is the difference between XML escape and HTML escape?
XML and HTML share most entities (<, >, &, "). The key difference is that XML defines ' for the apostrophe, while HTML traditionally uses ' or ' in HTML5.
Is my data sent to a server when using this tool?
No, all escaping and unescaping operations are performed entirely in your browser using JavaScript. Your data never leaves your device, ensuring complete privacy and security.
Can this tool handle large XML files?
Yes, the tool processes text locally in your browser and can handle large inputs efficiently. Since all processing happens client-side, there are no file size limits imposed by server constraints.
What are XML numeric character references?
Besides named entities, XML supports numeric character references using Unicode code points. For example, < can be written as < or <, and & as & or &. These work for any Unicode character.
When should I use CDATA sections instead of escaping?
CDATA sections (<![CDATA[...]]>) are useful when you have large blocks of text containing many special characters, such as code snippets. CDATA tells the XML parser to treat the content as raw character data without parsing.
What happens if I escape already escaped text?
If you escape text that already contains entities like &, the ampersand will be escaped again to &amp;. Use the unescape function to first decode the text before re-escaping if needed.
How does XML escaping relate to XSS prevention?
XML escaping is a fundamental defense against Cross-Site Scripting (XSS) attacks. By converting special characters to entities, user input is rendered harmless when displayed in XML or HTML contexts.
What is the difference between escape and encode?
In the context of XML, escaping refers specifically to replacing special characters with entity references to ensure valid XML. Encoding is a broader term that can refer to character encoding (like UTF-8) or the escaping process.
Can I use this tool for SVG or XHTML content?
Yes, since SVG and XHTML are XML-based formats, the same escaping rules apply. Any content that must be valid XML can benefit from proper character escaping.
Why is the ampersand always escaped in XML?
The ampersand (&) must always be escaped in XML because it is the character that begins entity references. An unescaped & would be interpreted as the start of an entity, causing parsing errors.
What are the predefined entities in XML?
XML has five predefined entities: < (<), > (>), & (&), " ("), and ' ('). These are the only entities predefined in the XML specification.