XML URL encoding

URLs can only carry letters, digits and a few symbols safely. URL encoding, also called percent-encoding, replaces every other character with a % followed by two hexadecimal digits. XML is full of characters that need this treatment: the angle brackets of every tag, the slash in every end tag, the quotes and equals signs in attributes, and the spaces.

1. Letters, digits and a few safe symbols such as - _ . ~ stay as they are, so tag names and text remain readable.
2. Every other character is turned into its UTF-8 bytes.
3. Each byte is written as % plus two hex digits: < is byte 3C, so it becomes %3C.

The result is one long string with no spaces or special characters, which a server decodes back into the original XML.

Both change special characters, but for different reasons, and they are easy to mix up. XML escaping keeps a document well-formed; URL encoding lets data travel safely inside a URL.

To send XML in a URL, URL-encode it and nothing else. You do not need to XML-escape it first; the receiving server decodes the URL encoding and gets your XML back exactly. If you need to escape characters inside the XML itself, use the XML escape tool.

encodeURIComponent(xmlString)                     // JavaScript
rawurlencode($xmlString);                         // PHP
System.Web.HttpUtility.UrlEncode(xmlString);      // C# / .NET
URLEncoder.encode(xmlString, "UTF-8");            // Java
urllib.parse.quote(xml_string, safe="")           # Python

They differ in one detail: how they write a space. JavaScript, PHP’s rawurlencode and Python’s quote use %20. C#’s HttpUtility.UrlEncode and Java’s URLEncoder use +, the style HTML forms use. Servers read both correctly in a query string; if the receiving side expects %20, pick it in the tool, or in C# use Uri.EscapeDataString() instead.

In JavaScript, use encodeURIComponent, not encodeURI. The second one is meant for whole URLs and leaves &, =, / and ? alone, which breaks a query string as soon as the XML contains them.