While reviewing some client’s code, I noticed they were generating and parsing XML and HTML by hand (do not ever do that yourself!).
Before refactoring this into something that uses libraries that properly understand XML and HTML, I needed to assess some of the risks.
A major risk is to get the escaping (and unescaping) of XML and HTML right.
Time to finally organize some of my links on escaping HTML and XML that I had in my favourites list.
The starting point is the List of XML and HTML character entity references on Wikipedia. It is readable, complete and lists both kinds of escapes.
XML escapes
The official W3C text that describes XML escaping is hard to read.
There are only 5 predefined XML entities for characters that can (some must) be escaped. This table is derived from the Wikipedia article.
| Name | Character | Unicode code point (decimal) |
Standard | When to escape (from the XML 1.0 standard) | Description |
|---|---|---|---|---|---|
| quot | “ | U+0022 (34) | XML 1.0 | To allow attribute values to contain both single and double quotes | double quotation mark |
| amp | & | U+0026 (38) | XML 1.0 | Outside comment, a processing instruction, or a CDATA section | ampersand |
| apos | ‘ | U+0027 (39) | XML 1.0 | To allow attribute values to contain both single and double quotes | apostrophe (= apostrophe-quote) |
| lt | < | U+003C (60) | XML 1.0 | Outside comment, a processing instruction, or a CDATA section | less-than sign |
| gt | > | U+003E (62) | XML 1.0 | in content, when that string is not marking the end of a CDATA section | greater-than sign |







