# XML Escape / Unescape Escape and unescape XML special characters (& < > " ') with optional numeric references, slash escaping, and CDATA wrapping > Canonical page: https://elysiatools.com/en/tools/xml-escape - **Category:** Format Conversion - **Keywords:** xml, escape, unescape, encode, decode, entity, html entity, special characters, xml escape ## Overview The XML Escape / Unescape tool allows you to quickly encode or decode special characters in XML data, ensuring well-formed documents. It supports standard entity conversions, quote escaping, OWASP-recommended slash escaping, non-ASCII numeric references, and CDATA wrapping. ## Inputs - **Input Text** (textarea): Enter text to escape or unescape... - **Operation** (select) - **Escape Quotes (" ')** (checkbox) - **Escape Slash (/) - OWASP recommended** (checkbox) - **Convert non-ASCII to numeric references (&#xNNNN;)** (checkbox) - **Wrap in CDATA section** (checkbox) - **CDATA Element Tag (optional)** (text): e.g. description (leave empty for bare CDATA) ## When to use - When embedding raw text containing characters like '<', '>', or '&' inside XML tags without breaking the document structure. - When decoding escaped XML payloads received from APIs or configuration files back into readable plain text. - When wrapping complex code blocks or markup inside CDATA sections to prevent XML parsers from interpreting them. ## How it works - Paste your XML or plain text into the input text area. - Select the operation (Escape or Unescape) and configure options like quote escaping, slash escaping, or non-ASCII conversion. - Optionally enable CDATA wrapping and specify an element tag to enclose the escaped content. - The tool instantly processes the input and displays the escaped or unescaped text in the output field. ## Use cases - Preparing code snippets or HTML templates to be safely embedded inside XML configuration files. - Decoding XML-encoded API responses to extract the original text or payload. - Securing user-generated inputs against XML injection by escaping slashes and quotes before processing. ## Frequently asked questions ### What characters are escaped by default? By default, the tool escapes ampersands (&), less-than (<), greater-than (>), double quotes ("), and single quotes ('). ### Can I escape forward slashes? Yes, you can enable the 'Escape Slash' option to convert '/' to '/' for OWASP-compliant security. ### What does the CDATA option do? It wraps your input in a section, optionally enclosed in a custom XML tag, to prevent parsers from reading the content as markup. ### How does the numeric non-ASCII option work? It converts non-ASCII characters (like accented letters or symbols) into their hexadecimal numeric character references (&#xNNNN;). ### Does this tool validate XML syntax? No, this tool only escapes or unescapes characters and does not validate the overall syntax of your XML document. ## Related tools - [HTML Entity Encoder/Decoder](https://elysiatools.com/en/tools/html-entity-encoder): Encode and decode HTML entities - [Base32 Converter](https://elysiatools.com/en/tools/base32-converter): Encode and decode text to/from Base32 format with multiple variants - [Base58 Converter](https://elysiatools.com/en/tools/base58-converter): Encode and decode text to/from Base58 format with Bitcoin and Ripple variants - [Base64 Converter](https://elysiatools.com/en/tools/base64-converter): Encode and decode data to/from Base64 format with URL-safe options - [Base64URL Encoder/Decoder](https://elysiatools.com/en/tools/base64url-encoder): Encode and decode Base64URL (URL-safe Base64 variant used by JWT/JWS/JWE), with conversions between standard and URL-safe Base64 - [Data URI Generator](https://elysiatools.com/en/tools/data-uri-generator): Convert files into Data URIs (Base64 or percent-encoded) for inlining images, fonts, and assets directly into HTML, CSS, or Markdown - [Hex to String Converter](https://elysiatools.com/en/tools/hex-to-string): Convert text to and from hexadecimal strings with flexible spacing, prefix (0x/\x/U+), and case options - [Hex/Unicode Converter](https://elysiatools.com/en/tools/hex-unicode-converter): Convert characters to/from hex (\xXX) and Unicode (\uXXXX) escape sequences ## Samples - [Android Serialization Java Samples](https://elysiatools.com/en/samples/android-serialization-java): Android Java serialization examples including JSON serialization, deserialization, and XML parsing - [Android Serialization Kotlin Samples](https://elysiatools.com/en/samples/android-serialization-kotlin): Android Kotlin serialization examples including JSON serialization, deserialization, and XML parsing - [macOS Serialization Objective-C Samples](https://elysiatools.com/en/samples/macos-serialization-objectivec): macOS Objective-C serialization examples including JSON serialization, JSON deserialization, and XML parsing - [Web Data Serialization Go Samples](https://elysiatools.com/en/samples/web-serialization-go): Web Go data serialization examples including JSON encoding/decoding and XML parsing ## Related content - [Text Case, Encoding, and Normalization Conversion Tools](https://elysiatools.com/en/hubs/text-convert): Compare text case conversion, character-width conversion, encoding conversion, quoted-printable handling, and inline text normalization tools in one hub. - [Text Tools](https://elysiatools.com/en/hubs/text-utility): Explore 33 text tools for utility workflows and compare closely related utilities quickly. - [XML Conversion, Mapping, and XPath Tools](https://elysiatools.com/en/hubs/xml-convert): Curated tools for XML conversion, mapping, merging, and XPath extraction in one hub. - [HTML Extraction, Cleanup, and Markdown/PDF Export Tools](https://elysiatools.com/en/hubs/html-convert): Compare HTML cleanup, attribute extraction, image-source extraction, HTML-to-Markdown, and HTML-to-PDF tools in one hub for web content conversion workflows.