Key Facts
- Category
- Conversion & Encoding
- Input Types
- textarea, select, checkbox, text
- Output Type
- text
- Sample Coverage
- 4
- API Ready
- Yes
Overview
The XML Escape / Unescape tool allows you to quickly encode or decode special characters in XML data, ensuring well-formed documents. It supports standard entity conversions, quote escaping, OWASP-recommended slash escaping, non-ASCII numeric references, and CDATA wrapping.
When to Use
- •When embedding raw text containing characters like '<', '>', or '&' inside XML tags without breaking the document structure.
- •When decoding escaped XML payloads received from APIs or configuration files back into readable plain text.
- •When wrapping complex code blocks or markup inside CDATA sections to prevent XML parsers from interpreting them.
How It Works
- •Paste your XML or plain text into the input text area.
- •Select the operation (Escape or Unescape) and configure options like quote escaping, slash escaping, or non-ASCII conversion.
- •Optionally enable CDATA wrapping and specify an element tag to enclose the escaped content.
- •The tool instantly processes the input and displays the escaped or unescaped text in the output field.
Use Cases
Preparing code snippets or HTML templates to be safely embedded inside XML configuration files.
Decoding XML-encoded API responses to extract the original text or payload.
Securing user-generated inputs against XML injection by escaping slashes and quotes before processing.
Examples
1. Safely Embedding HTML in XML
Web Developer- Background
- A developer needs to store an HTML template inside an XML configuration file for a content management system.
- Problem
- The HTML contains '<' and '>' characters that break the XML parser.
- How to Use
- Paste the HTML code into the input, select 'Escape', keep 'Escape Quotes' checked, and run the tool.
- Example Config
-
Operation: Escape, Escape Quotes: True, Escape Slash: False, Numeric Non-ASCII: False, Use CDATA: False - Outcome
- The HTML tags are converted to safe entities like '<div>' which can be parsed inside XML without errors.
2. Wrapping Code in CDATA Tags
Integration Engineer- Background
- An engineer is configuring a SOAP API request that includes a raw SQL query containing multiple comparison operators.
- Problem
- Escaping every single character makes the SQL query unreadable in the source files.
- How to Use
- Input the SQL query, select 'Escape', check 'Wrap in CDATA section', and enter 'query' as the CDATA Element Tag.
- Example Config
-
Operation: Escape, Use CDATA: True, CDATA Element Tag: 'query' - Outcome
- The output wraps the SQL query in '<query><![CDATA[...]]></query>', keeping the query readable and XML-compliant.
3. Decoding API Response Payloads
QA Tester- Background
- A tester receives an XML response from a legacy system where the data fields are heavily escaped.
- Problem
- The text contains entities like '&' and '"', making it difficult to verify the actual content.
- How to Use
- Paste the escaped XML string into the input, select 'Unescape' as the operation, and run the tool.
- Example Config
-
Operation: Unescape - Outcome
- The entities are decoded back to standard characters like '&' and '"' for easy reading and validation.
Try with Samples
xml, html, textXML Samples
XML (eXtensible Markup Language) format examples from simple to complex structures
title token xml
Hex/Unicode Encoding Format Samples
Examples of hex (\xXX) and unicode (\uXXXX) escape sequence encoding formats
matched family text
Android Serialization Java Samples
Android Java serialization examples including JSON serialization, deserialization, and XML parsing
matched family xml,text
Android Serialization Kotlin Samples
Android Kotlin serialization examples including JSON serialization, deserialization, and XML parsing
matched family xml,text
Related Hubs
Text Case, Encoding, and Normalization Conversion Tools
Compare text case conversion, character-width conversion, encoding conversion, quoted-printable handling, and inline text normalization tools in one hub.
Text Tools
Explore 33 text tools for utility workflows and compare closely related utilities quickly.
XML Conversion, Mapping, and XPath Tools
Curated tools for XML conversion, mapping, merging, and XPath extraction in one hub.
HTML Extraction, Cleanup, and Markdown/PDF Export Tools
Compare HTML cleanup, attribute extraction, image-source extraction, HTML-to-Markdown, and HTML-to-PDF tools in one hub for web content conversion workflows.
FAQ
What characters are escaped by default?
By default, the tool escapes ampersands (&), less-than (<), greater-than (>), double quotes ("), and single quotes (').
Can I escape forward slashes?
Yes, you can enable the 'Escape Slash' option to convert '/' to '/' for OWASP-compliant security.
What does the CDATA option do?
It wraps your input in a <![CDATA[...]]> section, optionally enclosed in a custom XML tag, to prevent parsers from reading the content as markup.
How does the numeric non-ASCII option work?
It converts non-ASCII characters (like accented letters or symbols) into their hexadecimal numeric character references (&#xNNNN;).
Does this tool validate XML syntax?
No, this tool only escapes or unescapes characters and does not validate the overall syntax of your XML document.