XML URL decoding

URL encoding (percent-encoding) replaces the brackets, slashes, quotes and spaces in XML with a % and two hex digits, so the XML can travel inside a URL. Decoding reverses it:

1. Each percent sequence is turned back into its character: %3C into <, %3E into >, %22 into ".
2. Spaces come back from %20, or from + if the XML came from a form or a query string.
3. Characters that took several bytes, such as %C3%A9, are put back together into one character (é).

Once every reserved symbol is restored you have a normal XML document again. The tool then checks that it is well-formed and indents it so it is easy to read.

These are the codes you will see most in URL-encoded XML, and what each one decodes to:

Upper and lower case mean the same thing, so %3c is also <. If you see %25 followed by more digits, such as %253C, the XML was encoded twice; see below.

XML that passes through redirects, proxies or several systems is often URL-encoded again at each step. Every extra layer encodes the % signs of the one before as %25:

The tool keeps decoding until real tags appear, up to 16 layers, and says in the status line how many it undid. It also handles the other common mix-up: XML that was escaped as <note> before being URL-encoded comes out as normal <note> tags.

urllib.parse.unquote(encoded)                    # Python (unquote_plus if + means space)
decodeURIComponent(encoded)                       // JavaScript
urldecode($encoded);                              // PHP (+ becomes a space)
URLDecoder.decode(encoded, "UTF-8");              // Java (+ becomes a space)
Uri.UnescapeDataString(encoded);                  // C#

JavaScript’s decodeURIComponent leaves + as it is, so for form data replace it first: decodeURIComponent(s.replace(/\+/g, ' ')). Each function undoes one layer; call it again if the result still contains %3C.