XML escape and unescape

XML escaping replaces special characters with entity references, so an XML parser reads them as data instead of markup. A < normally starts a tag and an & starts an entity. When they are part of your text, you write them as < and & instead.

Without escaping, an ordinary sentence breaks the file:

<note>5 < 10 & 10 > 5</note>              ✗ parser error
<note>5 &lt; 10 &amp; 10 &gt; 5</note>    ✓ reads as "5 < 10 & 10 > 5"

Unescaping is the reverse: it turns < back into <, so you can read text copied out of an XML file, a log or an API response.

XML has five predefined entities. Each can also be written as a number, such as < for <:

Escaping all five everywhere is still valid XML, and most tools do it to be safe. Choose Element text in the tool to escape only what text between tags needs, or Attribute value to escape the quotes as well.

Most languages have a built-in function for it:

# Python: escape() for element text, quoteattr() for attributes
from xml.sax.saxutils import escape, quoteattr
escape('5 < 10 & 10 > 5')          # '5 &lt; 10 &amp; 10 &gt; 5'

// C# / .NET: escapes all five
System.Security.SecurityElement.Escape(text);

// JavaScript: no built-in, so replace & first
text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;').replace(/'/g, '&apos;');

// PHP
htmlspecialchars($text, ENT_XML1 | ENT_QUOTES, 'UTF-8');

// Java (Apache Commons Text)
StringEscapeUtils.escapeXml10(text);

In JavaScript the order matters: if & is not replaced first, the & in each new < gets escaped again. Better still, build the XML with a library such as Python’s ElementTree or .NET’s XElement and XmlWriter. They escape values for you, so you never do it by hand.

Switch the tool to Unescape and paste the escaped text. It turns the five entities back into characters, and also decodes numeric references in both forms: é and é are both é.

It also points out two common problems:

• Text escaped twice. < only becomes < after one pass. The tool spots this and offers to unescape again.
• HTML entities.  , © and — work in HTML but not in XML, where a parser stops with an error such as “Entity 'nbsp' not defined”. The tool decodes the common ones and lists them, so you can replace them with numbers such as  .

In code, Python’s xml.sax.saxutils.unescape() handles the basic entities, and C#’s System.Net.WebUtility.HtmlDecode() handles them all, numeric references included.