CodesBeautify

XML Escape

Convert the five characters XML reserves into their entities so any text can sit safely inside an element or attribute value.

Text
Escaped
Runs locally in your browser

About the XML Escape

XML reserves five characters: the ampersand, the less-than and greater-than signs, and the double and single quotes. Put a raw ampersand or angle bracket inside an element and the document stops being well-formed. This tool replaces each of them with the predefined entity, & for the ampersand, < and > for the angle brackets, " for the double quote and ' for the apostrophe. Those five names are the only ones XML defines on its own, without a document type declaration.

Strictly speaking, element content only requires the ampersand and the less-than sign to be escaped, and an attribute value additionally needs whichever quote character delimits it. Converting all five everywhere is harmless, saves having to think about which context the text is being pasted into, and matches what most serialisers emit.

The mistake worth avoiding is escaping the same text twice. Feed already-escaped markup through and & turns into &, which the consuming application then displays as the literal characters of an entity, the classic reason ampersands appear to multiply in a product feed. Escape raw text once, at the point where it is inserted into the document.

A realistic case is a title such as Fish & Chips going into an RSS or Merchant Centre feed, where that single raw ampersand makes the entire file fail to parse. Nothing else is changed: accented letters, symbols and emoji are valid in XML as long as the document's encoding, normally UTF-8, can represent them, so they pass through untouched. Confirm the result with the XML Validator, reverse it with XML Unescape, or switch to HTML Escape for HTML, where ' is not defined in older versions and ' is used instead.

How to use

  1. Paste the raw text on the left.
  2. Copy the escaped text on the right.
  3. Paste it into your XML element or attribute.

Common questions

Do I need to escape > as well?
It is only required inside CDATA-ending sequences and a few edge cases, but escaping it everywhere is harmless and conventional.
Why not use CDATA instead?
CDATA works for element content but not inside attributes, and it cannot contain the sequence ]]>. Escaping works everywhere.
Are non-ASCII characters converted to numeric entities?
No. They are valid as-is in UTF-8 XML. Use the HTML Escape tool with the "all" option if you need ASCII-only output.