You have to break your data into pieces to conceal the ]]>.

Here's the whole thing:

<![CDATA[]]]]><![CDATA[>]]>

The first <![CDATA[]]]]> has the ]]. The second <![CDATA[>]]> has the >.

Answer from S.Lott on Stack Overflow
Top answer
1 of 10
181

You have to break your data into pieces to conceal the ]]>.

Here's the whole thing:

<![CDATA[]]]]><![CDATA[>]]>

The first <![CDATA[]]]]> has the ]]. The second <![CDATA[>]]> has the >.

2 of 10
155

You cannot escape a CDATA end sequence. Production rule 20 of the XML specification is quite clear:

[20]    CData      ::=      (Char* - (Char* ']]>' Char*))

EDIT: This product rule literally means "A CData section may contain anything you want BUT the sequence ']]>'. No exception.".

EDIT2: The same section also reads:

Within a CDATA section, only the CDEnd string is recognized as markup, so that left angle brackets and ampersands may occur in their literal form; they need not (and cannot) be escaped using "&lt;" and "&amp;". CDATA sections cannot nest.

In other words, it's not possible to use entity reference, markup or any other form of interpreted syntax. The only parsed text inside a CDATA section is ]]>, and it terminates the section.

Hence, it is not possible to escape ]]> within a CDATA section.

EDIT3: The same section also reads:

2.7 CDATA Sections

[Definition: CDATA sections may occur anywhere character data may occur; they are used to escape blocks of text containing characters which would otherwise be recognized as markup. CDATA sections begin with the string "<![CDATA[" and end with the string "]]>":]

Then there may be a CDATA section anywhere character data may occur, including multiple adjacent CDATA sections inplace of a single CDATA section. That allows it to be possible to split the ]]> token and put the two parts of it in adjacent CDATA sections.

ex:

<![CDATA[Certain tokens like ]]> can be difficult and <invalid>]]> 

should be written as

<![CDATA[Certain tokens like ]]]]><![CDATA[> can be difficult and <valid>]]> 
🌐
W3Resource
w3resource.com › xml › CDATA-sections.php
XML CDATA - w3resource
November 7, 2025 - CDATA sections can be used to “block escape” literal text when replacing prohibited characters with entity references is undesirable. CDATA sections can appear inside element content and allow < and & character literals to appear.
🌐
Liquid Technologies
liquid-technologies.com › Reference › Glossary › XML_EscapingData.html
Escaping XML Data
Data within a CDATA block can not be escaped. When the XML document is parsed (Character references are not expanded), so any chars within a CDATA block are just seen as character data.
🌐
Quackit
quackit.com › xml › tutorial › xml_cdata.cfm
XML CDATA
This eliminates the need to go through the whole script, individually replacing all the potentially problematic characters. The XML processor knows to escape all data between the CDATA tags.

You have to break your data into pieces to conceal the ]]>.

Here's the whole thing:

<![CDATA[]]]]><![CDATA[>]]>

The first <![CDATA[]]]]> has the ]]. The second <![CDATA[>]]> has the >.

Answer from S.Lott on Stack Overflow
🌐
Datacadamia
datacadamia.com › markup › xml › cdata
XML - Character data (CDATA) - Escape
August 30, 2024 - All text that is not markup or comment constitutes the character data of the document (known as CDATA). CDATAPCDATAchild If you want to embedded reserved characters xml character in your document, you need to enclose them in a cdata section. An example of a CDATA section, in which andcharacter ...
🌐
Wikipedia
en.wikipedia.org › wiki › CDATA
CDATA - Wikipedia
January 13, 2026 - When the XML document is converted to a more limited character set, such as ASCII, characters that can no longer be represented are converted to &#nnn; character references for a lossless conversion. But within a CDATA section, these characters can not be represented at all, and have to be removed or converted to some equivalent, altering the content of the CDATA section.
Top answer
1 of 5
22

CDATA is primarily useful, IMO, for human readability. As far as a machine is concerned, there's no difference between CDATA and escaped text other than the length, at most. Perhaps the escaped version will take a little bit longer to process, but I say perhaps, because this shouldn't be a significant factor unless your application is mostly IO-bound.

Are people likely to be reading the XML? If not, just let the XML parser do what it does and don't worry about CDATA vs escaped text. If people will be reading this XML, then perhaps CDATA can be the better choice.

If you're going to have an XML element whose value is XML, then for this case, CDATA may be the better choice.

For more information, see for example the XML FAQ's question, When should I use a CDATA Marked Section?

2 of 5
6

I've seen people use CDATA for the above which is OK, and for wrapping things that are not XML - such as e.g. JSON or CSS - and that's a better reason to use it. The problem happens when people use it to quote element-based markup such as HTML, and then the confusion happens.

People do not expect

<![CDATA[<foo>bar</foo>]]>

to be identical to

&lt;foo&gt;bar&lt;/foo&gt;

as far as XML systems are concerned.

See RSS tag soup for examples of the horror of escaping levels.

You also have to be sure that the character sequence ']]>' will never appear in your wrapped data since that's the terminator.

So unless readability is paramount or you are wrapping non-element markup, I recommend avoiding CDATA.

Find elsewhere
🌐
Novixys Software
novixys.com › blog › what-characters-need-to-be-escaped-in-xml-documents
What Characters Need to be Escaped in XML Documents? | Novixys Software Dev Blog
January 2, 2017 - However, “>” cannot appear in the form “]]>” unless it is a part of CDATA ending sections. ... Within attributes, “>” is valid. ... However, ‘”‘ is not valid within double quotes; it must be encoded using “&quot;”. ... Similarly “‘” is not valid within single quotes. It must be encoded as “&apos;”: ... Comments can appear anywhere in a document outside of markup. Within comments, none of the 5 special characters must be escaped or encoded.
🌐
Transifex
community.transifex.com › tips and tricks
[Android XML] CDATA and " escaping - Tips and Tricks - Transifex
September 21, 2019 - In Android resource XMLs, you can use CDATA like this (especially useful if you don’t want to escape "): <string name="app_info_gplv3_note"><![CDATA[ You should have received a copy of the GNU General Public License alo…
🌐
Apache
xerces.apache.org › xerces2-j › javadocs › api › org › w3c › dom › CDATASection.html
CDATASection (XML Standard API) - Apache Xerces
CDATA sections are used to escape blocks of text containing characters that would otherwise be regarded as markup. The only delimiter that is recognized in a CDATA section is the "]]>" string that ends the CDATA section. CDATA sections cannot be nested. Their primary purpose is for including ...
🌐
Evertpot
evertpot.com › 184
CDATA in xml.. bad idea?
CDATA can't be used to just dump in any type of content that won't work in normal XML sections.. You're still obligated to make your data valid unicode. In fact, it's the opposite; There's no way you could ever escape the ]]> character sequence.
Top answer
1 of 13
1263

CDATA stands for Character Data and it means that the data in between these strings includes data that could be interpreted as XML markup, but should not be.

The key differences between CDATA and comments are:

  • As Richard points out, CDATA is still part of the document, while a comment is not.
  • In CDATA you cannot include the string ]]> (CDEnd), while in a comment -- is invalid.
  • Parameter Entity references are not recognized inside of comments.

This means given these four snippets of XML from one well-formed document:

<!ENTITY MyParamEntity "Has been expanded">

<!--
Within this comment I can use ]]>
and other reserved characters like <
&, ', and ", but %MyParamEntity; will not be expanded
(if I retrieve the text of this node it will contain
%MyParamEntity; and not "Has been expanded")
and I can't place two dashes next to each other.
-->

<![CDATA[
Within this Character Data block I can
use double dashes as much as I want (along with <, &, ', and ")
*and* %MyParamEntity; will be expanded to the text
"Has been expanded" ... however, I can't use
the CEND sequence. If I need to use CEND I must escape one of the
brackets or the greater-than sign using concatenated CDATA sections.
]]>

<description>An example of escaped CENDs</description>
<!-- This text contains a CEND ]]> -->
<!-- In this first case we put the ]] at the end of the first CDATA block
     and the > in the second CDATA block -->
<data><![CDATA[This text contains a CEND ]]]]><![CDATA[>]]></data>
<!-- In this second case we put a ] at the end of the first CDATA block
     and the ]> in the second CDATA block -->
<alternative><![CDATA[This text contains a CEND ]]]><![CDATA[]>]]></alternative>
2 of 13
377

A CDATA section is "a section of element content that is marked for the parser to interpret as only character data, not markup."

Syntactically, it behaves similarly to a comment:

<exampleOfAComment>
<!--
    Since this is a comment
    I can use all sorts of reserved characters
    like > < " and &
    or write things like
    <foo></bar>
    but my document is still well-formed!
-->
</exampleOfAComment>

... but it is still part of the document:

<exampleOfACDATA>
<![CDATA[
    Since this is a CDATA section
    I can use all sorts of reserved characters
    like > < " and &
    or write things like
    <foo></bar>
    but my document is still well formed!
]]>
</exampleOfACDATA>

Try saving the following as a .xhtml file (not .html) and open it using FireFox (not Internet Explorer) to see the difference between the comment and the CDATA section; the comment won't appear when you look at the document in a browser, while the CDATA section will:

<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" >
<head>
<title>CDATA Example</title>
</head>
<body>

<h2>Using a Comment</h2>
<div id="commentExample">
<!--
You won't see this in the document
and can use reserved characters like
< > & "
-->
</div>

<h2>Using a CDATA Section</h2>
<div id="cdataExample">
<![CDATA[
You will see this in the document
and can use reserved characters like
< > & "
]]>
</div>

</body>
</html>

Something to take note of with CDATA sections is that they have no encoding, so there's no way to include the string ]]> in them. Any character data which contains ]]> will have to - as far as I know - be a text node instead. Likewise, from a DOM manipulation perspective you can't create a CDATA section which includes ]]>:

var myEl = xmlDoc.getElementById("cdata-wrapper");
myEl.appendChild(xmlDoc.createCDATASection("This section cannot contain ]]>"));

This DOM manipulation code will either throw an exception (in Firefox) or result in a poorly structured XML document: http://jsfiddle.net/9NNHA/

🌐
TutorialsPoint
tutorialspoint.com › xml › xml_cdata_sections.htm
XML - CDATA Sections
CDATA cannot contain the string "]]>" anywhere in the XML document.
🌐
Stack Overflow
stackoverflow.com › questions › 38899525 › escape-xml-characters-without-escaping-cdata-tag › 38902004
java - Escape XML characters without escaping CDATA tag - Stack Overflow
I'm trying to serialize a class using JAXB that has some CDATA fields, and some fields that include special characters that need to be escaped (including < and >). The problem is I can't get the escape handling to work correctly for both of these cases. Using a Custom CDATA Adapter, if I setting the following property on my marshaller, jaxbMarshaller.setProperty(CharacterEscapeHandler.class.getName(), (CharacterEscapeHandler) (ch, start, length, isAttVal, out) -> out.write(ch, start, length)); ... You can use com.sun.xml.bind.marshaller.CharacterEscapeHandler interface to resolve your issue.
🌐
Liquid Technologies
liquid-technologies.com › Reference › Glossary › XML_CDATA.html
XML CDATA
There is no way to escape the CDATA end literal ']]>' because of this there is no way to nest CDATA blocks, and for that matter no way to store the literal ']]>' within a CDATA block. Because of this care should be taken to avoid inadvertently entering the literal ']]>' into the body of a CDATA ...
🌐
University of Bologna
lia.deis.unibo.it › Courses › TecnologieWeb0708 › materiale › laboratorio › guide › j2ee14tutorial7 › JAXPSAX6.html
Displaying Special Characters and CDATA
But if the output text is in a CDATA section, then the substitutions should not occur, resulting in text like that in the earlier example. In a simple program such as our Echo application, it's not a big deal. But many XML-filtering applications will want to keep track of whether the text appears in a CDATA section, so that they can treat special characters properly.
🌐
InterSystems
community.intersystems.com › post › handling-cdata-xml-responses-removing-string-properties-clean-integration
Handling CDATA in XML Responses: Removing in String Properties for Clean
We do need to find a way to remove the <![CDATA[]]> because the system which receives the response needs it to be raw without any CDATA. We do have checked that it only shows this behaviour with special character which conflict with the ones that are used in XML as ">" and "<". ... However the previous post does not cover this topic. ... Thanks for your help, time, answers, teaching and support. ... You need CONTENT=ESCAPE instead of CONTENT=STRING.
🌐
Devzery
devzery.com › post › cdata-in-xml-a-comprehensive-guide-for-developers
CDATA in XML: A Comprehensive Guide for Developers
August 28, 2024 - CDATA stands for Character Data, and it is used in XML to include blocks of text that should not be parsed by the XML parser as XML elements or attributes. The main purpose of CDATA is to allow the inclusion of text that contains characters normally treated as markup, such as <, >, and &, without requiring them to be escaped.
🌐
Getsymphony
getsymphony.com › discuss › issues › view › 429
“Escape ]]> in CDATA sections” – Issues – Discuss – Symphony.
This is what this issue was about, wasn’t it? It does fix that. My thinking is that the CDATA section contents should actually be HTML encoded. No, you are not allowed to do that. ... I see this as correct behaviour. ... This is incorrect behaviour. You’re not allowed to escape contents ...