What XML escaping does
XML uses the same markup delimiters as HTML, so text that contains <, >, &, quotes or apostrophes must be escaped before it can sit safely inside an element or an attribute. This tool converts text to escaped XML and back again.
Escaping or CDATA?
There are two ways to include awkward text in XML. Escaping replaces the special characters with entities, which is always safe. A CDATA section wraps the text verbatim, which keeps it readable but cannot contain the string ]]>. For generated or machine-written XML, escaping is the more predictable choice.
Frequently asked questions
Which characters are escaped in XML?
The five predefined entities are & < > " and '. Escaping & last is important: if you escape it first you will corrupt the entities you just produced.
When should I use CDATA instead of escaping?
Use CDATA when the content is large, contains many special characters, or should stay human-readable, such as embedded HTML. Remember that a CDATA section cannot contain the sequence ]]>, and that escaping is required inside attributes.
Is XML escaping the same as HTML escaping?
The five core entities are identical. The difference is that HTML defines hundreds of named entities and browsers are forgiving, whereas XML only knows the five predefined ones plus numeric character references, and is strict.
Is my text uploaded?
No. Escaping and unescaping run entirely in your browser, so feed files and API payloads stay private.