Convert special characters to XML entities

Escape XML markup characters for safe insertion into text or attributes.

freeworks offlinenothing uploaded
ToolXML Escape
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

Ampersands, less-than, and greater-than signs become predefined entities; optional quote entities protect attribute delimiters, and optional newline references encode line breaks. Ampersands are replaced first so generated entities are not escaped again by later replacements.

  • Markup delimiters are always escaped.
  • Quotes and newlines are optional for text-node use.

Worked example

Escape HTML tags and special characters
Escape angle brackets, ampersands, and quotes for safe embedding in XML documents
Input
											<script>alert("XSS & injection")</script>
Output
												&lt;script&gt;alert(&quot;XSS &amp; injection&quot;)&lt;/script&gt;

When to use this

XML elements, attributes, SOAP payloads, and RSS generators escape user text.

Edge cases

  • Existing &amp; becomes &amp;amp; because input is treated as raw text.
  • Quotes are safe in element text but escaped by default for attribute reuse.
  • Newline references appear only when enabled.

References