XML entity handling in API XML requests: incident response

XML escape matrix

Primary rule for this page

& -> &

Focus for this query

• Escape reserved XML characters in text/attributes.
• Keep one well-formed root and validate after each change.
• Fix the first parser error before touching downstream nodes.

CDATA vs escaping

Use escaping for normal text/attributes. Use CDATA when large literal blocks are easier to keep unchanged.

• Escaping is safest for machine-generated XML fields.
• CDATA is convenient for long snippets, but still requires clean XML structure.
• Never include raw ]]> inside CDATA without splitting/escaping.

Example

<!-- Text node -->
<title>Tom &amp; Jerry</title>

<!-- Attribute value -->
<link href="/search?q=a&amp;b=1" />

<!-- CDATA for rich text -->
<snippet><![CDATA[if (a < b && b > 0) { return a; }]]></snippet>

Fast fix workflow

1. Find first parser error line/column.
2. Replace reserved character/entity usage at that location.
3. Re-validate immediately after each edit.
4. Convert/export only when parser reports clean XML.

Common parser signals

• EntityRef: expecting ; — raw & or incomplete entity.
• Undefined entity — entity not declared/unsupported by parser.
• Unescaped ampersand in URL — use & inside XML.

FAQ

Is anything uploaded to a server? No. All processing happens locally in your browser. Files are never uploaded.

What is the recommended workflow? Validate the input, fix the first real issue, validate again, then export/convert. This avoids compounding errors.