How to use the xml escape
- Paste your plain text or XML markup into the input area.
- Select Escape text for XML to convert special characters, or Validate XML well-formedness to check structure.
- The result updates instantly as you type or change modes.
- For validation, read the reported line and column if an error is found.
How XML escaping works
Five characters have special meaning in XML markup and must be replaced with predefined entities when they appear as literal text content or attribute values. The xml escape process converts each one:
| Character | Entity | Name |
|---|---|---|
& | & | Ampersand |
< | < | Less-than sign |
> | > | Greater-than sign |
" | " | Double quote |
' | ' | Apostrophe |
For example, the string Tom & Jerry <3 becomes Tom & Jerry <3. Without this step, an XML parser would interpret the ampersand as the start of an entity reference and the less-than sign as the start of a new tag.
What the validator checks
The validation mode uses a hand-written tokenizer rather than the browser's DOMParser. It scans the input character by character and verifies several rules required for well-formed XML:
- Every opening tag has a matching closing tag with the same name, properly nested.
- Attribute values are enclosed in matching single or double quotes.
- Only the five predefined entities (
amp,lt,gt,quot,apos) and numeric character references (decimal&#nnn;or hexadecimal&#xHHH;) are allowed. - Comments start with
<!--and end with-->without containing--inside. - CDATA sections use the exact syntax
<![CDATA[...]]>. - Processing instructions start with
<?and end with?>.
If any rule is broken, the tool stops and reports the line number and column where the first error was detected.
Limitations of this tokenizer
This tool intentionally does not support DOCTYPE declarations or external entities. A DOCTYPE can reference external DTD files that define additional entities, which introduces security risks such as XML External Entity (XXE) attacks. By rejecting DOCTYPEs entirely, the validator stays safe and predictable. If your document requires a DOCTYPE, remove it before pasting the content here.
The tokenizer also does not enforce namespace rules or schema constraints. It only checks structural well-formedness according to the core XML specification.
When to escape versus when to use CDATA
Escaping is the standard way to include special characters in element content and attribute values. However, if you need to embed a large block of text that contains many angle brackets and ampersands (such as source code), wrapping it in a CDATA section is often cleaner. Inside <![CDATA[ ... ]]>, the parser treats everything as raw character data until it sees the closing ]]> sequence.
Keep in mind that CDATA cannot contain the string ]]> itself. If your data includes that sequence, you must split it across multiple CDATA sections or fall back to xml escape encoding instead.
Common mistakes with XML entities
A frequent error is double-escaping. If text has already been escaped once, running it through an xml escape function again will turn & into &amp;. Always check whether your data source provides raw or pre-escaped strings before processing them.
Another mistake is using named entities beyond the five predefined ones. Unlike HTML, XML does not recognize entities like or © unless they are explicitly declared in a DTD. Since this tool does not process DTDs, use numeric references instead:   for a non-breaking space or © for the copyright symbol.
Worked examples
| Example | Input | Result |
|---|---|---|
| Escape a sentence | Input text or XML: Price < $5 & tax > 0%; Mode: escape | Price < $5 & tax > 0% |
| Validate simple XML | Input text or XML: <root><item id="1">Hello</item></root>; Mode: validate | Valid XML. The document is well-formed. |
| CDATA section | Input text or XML: <data><![CDATA[Some <raw> & unescaped]]></data>; Mode: validate | Valid XML. The document is well-formed. |
FAQ
What does xml escape mean?
It means replacing the five reserved characters (ampersand, less-than, greater-than, double quote, apostrophe) with their corresponding XML entity references so they are treated as literal text rather than markup.
Which characters must be escaped in XML?
The five characters are &, <, >, ", and '. In text content, strictly only & and < are required, but escaping all five is safest, especially inside attribute values.
Does this tool support DOCTYPE declarations?
No. DOCTYPE declarations and external entities are intentionally excluded to prevent security issues like XXE attacks. Remove any DOCTYPE before validating.
Can I use this to check if my XML is valid?
The validation mode checks well-formedness: correct nesting, a single root element, closed tags, quoted and non-duplicated attributes, and legal entity and character references. It does not validate against a specific XML Schema or DTD.
How do I reverse the escaping?
To convert entities back to plain characters, use the xml unescape tool on this site.
Why does the validator report a line and column?
Reporting the exact position helps you locate the syntax error quickly in large documents. The count starts at line 1, column 1.
Is my data sent to a server?
No. Both the escaping and the validation run entirely in your browser using JavaScript. Nothing is uploaded anywhere.