Escape XML characters without double-encoding data
Published by XSDHub · How our guides and examples are made
Why a normal sentence can break XML
A customer name such as Pine & Paper contains an ampersand that the XML parser treats as the start of a reference. In element text, write Pine & Paper. Likewise, use < for a literal less-than sign. The parser returns the original characters to the application; escaped markup is a representation of the text, not a change to the customer name.
A broken example and a working correction
These examples were checked on 26 October 2026 using XSDHub’s libxml2-based engine. Other validators may phrase the same problem differently.
What XSDHub reports
xmlParseEntityRef: no nameThe buttons open a new workbench page with the example loaded. Choose Validate XML to run the check. Your own files are not uploaded.
Element text and attributes
In text content, a quote normally needs no special treatment. Inside an attribute, escape whichever quote character delimits the value, or choose the other delimiter. This example represents a company name containing an ampersand and a message containing double quotes.
<company name="Pine & Paper">
<message>Say "hello" when 2 < 3.</message>
<label text="Say "hello""/>
</company>The five predefined references
Use & for &, < for <, > for >, " for a double quote and ' for an apostrophe when the context calls for them. A plain > is usually allowed in text, but the sequence ]]> cannot appear there as ordinary character data. Numeric references such as & represent characters too. HTML-only names such as are not automatically available in XML; use a literal non-breaking space or   instead.
When CDATA is useful
CDATA can make a block of text containing markup-like characters easier to read. It belongs in element content, not inside an attribute. References inside CDATA are literal text rather than decoded entities, and the closing sequence ]]> cannot occur inside a single CDATA block. CDATA blocks cannot nest.
<snippet><![CDATA[if (a < b && ready) { run(); }]]></snippet>Avoid escaping twice
If your source value is already the character &, pass that value to an XML serializer and let it escape once. Manually converting it to & before serialization can produce &amp;. After parsing, that double-escaped document contains the visible text & instead of the intended ampersand. Decide whether an input is raw data or serialized XML before applying replacements.
Validate the serialized result
Paste the complete output into the XML syntax validator. Fix the earliest reference or quoting error, then check again. Formatting makes the structure easier to read but does not recover the intended data from a broken escape. XSDHub does not allow custom entity declarations or DTDs, so use predefined references, numeric references or normal Unicode text.
Checking the same rule across many files?
Start with the free single-document check. Pro adds batches of up to 25 XML files and 10 saved schemas; Team adds larger batches and a shared library. Both use the same validation engine.
Compare batch-validation plans →