XML Escape / Unescape

XML Escape / Unescape | Online Free Tool | Elysia Tools

Tool usage guide

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Category: Format Conversion
Input types: textarea, select, checkbox, text
Output type: text
Sample coverage: 4
API ready: Yes

Overview

The XML Escape / Unescape tool allows you to quickly encode or decode special characters in XML data, ensuring well-formed documents. It supports standard entity conversions, quote escaping, OWASP-recommended slash escaping, non-ASCII numeric references, and CDATA wrapping.

When to use

When embedding raw text containing characters like '<', '>', or '&' inside XML tags without breaking the document structure.
When decoding escaped XML payloads received from APIs or configuration files back into readable plain text.
When wrapping complex code blocks or markup inside CDATA sections to prevent XML parsers from interpreting them.

How it works

1Paste your XML or plain text into the input text area.
2Select the operation (Escape or Unescape) and configure options like quote escaping, slash escaping, or non-ASCII conversion.
3Optionally enable CDATA wrapping and specify an element tag to enclose the escaped content.
4The tool instantly processes the input and displays the escaped or unescaped text in the output field.

Use cases

Preparing code snippets or HTML templates to be safely embedded inside XML configuration files.
Decoding XML-encoded API responses to extract the original text or payload.
Securing user-generated inputs against XML injection by escaping slashes and quotes before processing.

Examples

1. Safely Embedding HTML in XML

Web Developer

Background

A developer needs to store an HTML template inside an XML configuration file for a content management system.

Problem

The HTML contains '<' and '>' characters that break the XML parser.

How to use

Paste the HTML code into the input, select 'Escape', keep 'Escape Quotes' checked, and run the tool.

Operation: Escape, Escape Quotes: True, Escape Slash: False, Numeric Non-ASCII: False, Use CDATA: False

Outcome

The HTML tags are converted to safe entities like '<div>' which can be parsed inside XML without errors.

2. Wrapping Code in CDATA Tags

Integration Engineer

Background

An engineer is configuring a SOAP API request that includes a raw SQL query containing multiple comparison operators.

Problem

Escaping every single character makes the SQL query unreadable in the source files.

How to use

Input the SQL query, select 'Escape', check 'Wrap in CDATA section', and enter 'query' as the CDATA Element Tag.

FAQ

What characters are escaped by default?

By default, the tool escapes ampersands (&), less-than (<), greater-than (>), double quotes ("), and single quotes (').

Can I escape forward slashes?

Yes, you can enable the 'Escape Slash' option to convert '/' to '/' for OWASP-compliant security.

What does the CDATA option do?

It wraps your input in a <![CDATA[...]]> section, optionally enclosed in a custom XML tag, to prevent parsers from reading the content as markup.

How does the numeric non-ASCII option work?

It converts non-ASCII characters (like accented letters or symbols) into their hexadecimal numeric character references (&#xNNNN;).

Does this tool validate XML syntax?

No, this tool only escapes or unescapes characters and does not validate the overall syntax of your XML document.

Operation: Escape, Use CDATA: True, CDATA Element Tag: 'query'

3. Decoding API Response Payloads

QA Tester

Background

A tester receives an XML response from a legacy system where the data fields are heavily escaped.

Problem

The text contains entities like '&' and '"', making it difficult to verify the actual content.

How to use

Paste the escaped XML string into the input, select 'Unescape' as the operation, and run the tool.

Operation: Unescape

Outcome

The entities are decoded back to standard characters like '&' and '"' for easy reading and validation.

Run this tool

Inputs

Result

Examples that match this tool

Continue with connected tools and hubs

Inputs

Result

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Overview

When to use

How it works

Use cases

Examples

1. Safely Embedding HTML in XML

2. Wrapping Code in CDATA Tags

FAQ

Android Serialization Java Samples

Android Serialization Kotlin Samples

macOS Serialization Objective-C Samples

Web Data Serialization Go Samples

HTML Entity Encoder/Decoder

Base32 Converter

Base58 Converter

Base64 Converter

Text Case, Encoding, and Normalization Conversion Tools

Text Tools

XML Conversion, Mapping, and XPath Tools

HTML Extraction, Cleanup, and Markdown/PDF Export Tools

3. Decoding API Response Payloads