XML escape for elements and attributes
XML has exactly five predefined entities, and an XML escape replaces the matching characters with them. Without escaping, a single ampersand in a product name or a < in a formula makes the whole document fail to parse — XML parsers are strict and stop at the first error, unlike browsers reading HTML.
| Character | Entity | Required where |
|---|---|---|
& | & | Always |
< | < | Always |
> | > | Only in the sequence ]]>, escaped for safety |
" | " | Inside double-quoted attributes |
' | ' | Inside single-quoted attributes |
This tool always escapes all five, so the output is safe in text nodes and in attributes regardless of which quote style the document uses. Unlike the HTML escaper, it uses ' for the apostrophe, which is a native XML entity.
Example
Input:
<price currency="EUR">5 & 6 'ok'</price>Output:
<price currency="EUR">5 & 6 'ok'</price>XML escaping vs. CDATA sections
For long blocks of text that contain many special characters — embedded HTML, SQL or code — you can wrap the content in a CDATA section instead: <![CDATA[ 5 < 6 & more ]]>. Inside CDATA nothing needs escaping except the terminator ]]> itself. Escaping is the better choice for short values and attributes, because attributes cannot contain CDATA.
Characters XML cannot contain at all
XML 1.0 forbids most control characters (U+0000 to U+001F, except tab, line feed and carriage return), even as numeric references like . Escaping does not fix these; remove them before building the document. This tool leaves non-ASCII characters such as £ or é unchanged, which is correct for UTF-8 documents.
Other entities you may know from HTML, like or ©, are not defined in XML unless a DTD declares them. Use the literal character or a numeric reference ( ) instead.
Escaping XML in code
Most languages have a helper, but they do not all escape the same set. Python’s xml.sax.saxutils.escape() handles only &, < and > unless you pass extra entities, and quoteattr() is meant for attribute values. PHP needs htmlspecialchars($s, ENT_XML1 | ENT_QUOTES) to produce '. In .NET, SecurityElement.Escape() covers all five. Building documents with a DOM or XML writer API is safer still, because it escapes values for you.
Related tools
Decode entities with XML Unescape, tidy the finished document with the XML Formatter, or check it parses with the XML Validator. The escaping runs in your browser, so nothing is uploaded.