The forward slash is valid as is and does not need further encoding.
The only reserved characters are:
>
<
&
%
For even more XML entities - http://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_references
Answer from Ray Booysen on Stack OverflowThe forward slash is valid as is and does not need further encoding.
The only reserved characters are:
>
<
&
%
For even more XML entities - http://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_references
I don't think the comments in this thread are entirely correct since if you use a schema (XSD) you could define elements with names Jim, Bob and Jim/Bob without any issues. But then when you want to define the element and entity:
<names>
<Jim>Carrey</Jim>
<Bob>Jones</Bob>
<Jim/Bob>Six figured Hillbilly</Jim/Bob>
</names>
The problems are obvious.
If you use an appropriate class or library, they will do the escaping for you. Many XML issues are caused by string concatenation.
XML escape characters
There are only five:
" "
' '
< <
> >
& &
Escaping characters depends on where the special character is used.
The examples can be validated at the W3C Markup Validation Service.
Text
The safe way is to escape all five characters in text. However, the three characters ", ' and > needn't be escaped in text:
<?xml version="1.0"?>
<valid>"'></valid>
Attributes
The safe way is to escape all five characters in attributes. However, the > character needn't be escaped in attributes:
<?xml version="1.0"?>
<valid attribute=">"/>
The ' character needn't be escaped in attributes if the quotes are ":
<?xml version="1.0"?>
<valid attribute="'"/>
Likewise, the " needn't be escaped in attributes if the quotes are ':
<?xml version="1.0"?>
<valid attribute='"'/>
Comments
All five special characters must not be escaped in comments:
<?xml version="1.0"?>
<valid>
<!-- "'<>& -->
</valid>
CDATA
All five special characters must not be escaped in CDATA sections:
<?xml version="1.0"?>
<valid>
<![CDATA["'<>&]]>
</valid>
Processing instructions
All five special characters must not be escaped in XML processing instructions:
<?xml version="1.0"?>
<?process <"'&> ?>
<valid/>
XML vs. HTML
HTML has its own set of escape codes which cover a lot more characters.
New, simplified answer to an old, commonly asked question...
Simplified XML Escaping (prioritized, 100% complete)
Always (90% important to remember)
- Escape
<as<unless<is starting a<tag/>or other markup. - Escape
&as&unless&is starting an&entity;.
- Escape
Attribute Values (9% important to remember)
attr="'Single quotes'are ok within double quotes."attr='"Double quotes"are ok within single quotes.'- Escape
"as"and'as'otherwise.
Comments, CDATA, and Processing Instructions (0.9% important to remember)
<!--Within comments-->nothing has to be escaped but no--strings are allowed.<![CDATA[Within CDATA]]>nothing has to be escaped, but no]]>strings are allowed.<?PITargetWithin PIs?>nothing has to be escaped, but no?>strings are allowed.
Esoterica (0.1% important to remember)
- Escape control codes in XML 1.1 via Base64 or Numeric Character References.
- Escape
]]>as]]>unless]]>is ending a CDATA section.
(This rule applies to character data in general – even outside a CDATA section.)