107

Is there any C# function which could be used to escape and un-escape a string, which could be used to fill in the content of an XML element?

I am using VSTS 2008 + C# + .Net 3.0.

EDIT 1: I am concatenating simple and short XML file and I do not use serialization, so I need to explicitly escape XML character by hand, for example, I need to put a<b into <foo></foo>, so I need escape string a<b and put it into element foo.

5

11 Answers 11

143

SecurityElement.Escape(string s)

7
  • 10
    This answer escapes quotes, unlike the selected answer.
    – user1228
    Mar 15, 2010 at 16:04
  • 2
    This answer doesn't seem to work with invalid characters like �
    – Haacked
    Mar 16, 2012 at 3:11
  • 2
    This answer is incomplete. It only answers half of the question. Sep 13, 2012 at 20:43
  • 1
    Agree with above comments - incomplete and not 100% accurate.
    – G. Stoynev
    Apr 5, 2013 at 0:05
  • 5
    To unsecape: text = System.Security.SecurityElement.FromString(xmlContent).Text;
    – oo_dev
    Dec 17, 2018 at 14:44
83
public static string XmlEscape(string unescaped)
{
    XmlDocument doc = new XmlDocument();
    XmlNode node = doc.CreateElement("root");
    node.InnerText = unescaped;
    return node.InnerXml;
}

public static string XmlUnescape(string escaped)
{
    XmlDocument doc = new XmlDocument();
    XmlNode node = doc.CreateElement("root");
    node.InnerXml = escaped;
    return node.InnerText;
}
15
  • 5
    You don't even need to append the element to the document. However, I'd still say that it's best not to try to do this in the first place - it sounds like George is making work for himself by doing things by hand...
    – Jon Skeet
    Jul 15, 2009 at 17:01
  • 16
    I really dislike this answer because it's too heavy-weight. XmlDocument is going to use XmlReader/XmlWriter to do the real work, so why not cut to the chase and avoid that heavy DOM? Jul 15, 2009 at 19:49
  • 7
    @Will, the OP asked for a function that will escape a text which could be put in a XML element and not attribute. My function doesn't escape single or double quotes because they can be put in XML elements. Mar 16, 2010 at 12:24
  • 5
    @darin good point, and one that should be stressed. I am satisfied with the result of this conversation, and withdraw my reservations. Good day, sir.
    – user1228
    Mar 16, 2010 at 13:15
  • 2
    @William ; and = are not characters that need to be escaped in XML.
    – JLRishe
    Oct 30, 2016 at 18:02
46

EDIT: You say "I am concatenating simple and short XML file and I do not use serialization, so I need to explicitly escape XML character by hand".

I would strongly advise you not to do it by hand. Use the XML APIs to do it all for you - read in the original files, merge the two into a single document however you need to (you probably want to use XmlDocument.ImportNode), and then write it out again. You don't want to write your own XML parsers/formatters. Serialization is somewhat irrelevant here.

If you can give us a short but complete example of exactly what you're trying to do, we can probably help you to avoid having to worry about escaping in the first place.


Original answer

It's not entirely clear what you mean, but normally XML APIs do this for you. You set the text in a node, and it will automatically escape anything it needs to. For example:

LINQ to XML example:

using System;
using System.Xml.Linq;

class Test
{
    static void Main()
    {
        XElement element = new XElement("tag",
                                        "Brackets & stuff <>");

        Console.WriteLine(element);
    }
}

DOM example:

using System;
using System.Xml;

class Test
{
    static void Main()
    {
        XmlDocument doc = new XmlDocument();
        XmlElement element = doc.CreateElement("tag");
        element.InnerText = "Brackets & stuff <>";
        Console.WriteLine(element.OuterXml);
    }
}

Output from both examples:

<tag>Brackets &amp; stuff &lt;&gt;</tag>

That's assuming you want XML escaping, of course. If you're not, please post more details.

4
  • Thanks Jon, I have put more details into my original post EDIT 1 section. Appreciate if you could give me some comments and advice. :-)
    – George2
    Jul 15, 2009 at 16:40
  • "after XML escaping" -- you mean? Could you speak in some other words please? English is not my native language. :-)
    – George2
    Jul 15, 2009 at 16:41
  • Hi Jon, how to un-escape from XML format into normal string format, i.e. from input "Brackets &amp; stuff &lt;&gt;", we get output "Brackets & stuff <>"?
    – George2
    Jul 15, 2009 at 16:50
  • 3
    @George2: You ask the XElement for its Value, or the XmlElement for its InnerText.
    – Jon Skeet
    Jul 15, 2009 at 16:56
28

Thanks to @sehe for the one-line escape:

var escaped = new System.Xml.Linq.XText(unescaped).ToString();

I add to it the one-line un-escape:

var unescapedAgain = System.Xml.XmlReader.Create(new StringReader("<r>" + escaped + "</r>")).ReadElementString();
2
  • XText does not escape quotes. Aug 26, 2015 at 9:41
  • It also doesn't escape illegal characters.
    – Suncat2000
    Mar 17, 2022 at 12:27
11

George, it's simple. Always use the XML APIs to handle XML. They do all the escaping and unescaping for you.

Never create XML by appending strings.

5
  • Words to live by. There are many XML API options available, but the one thing we should all agree on is that manual string concatenation is not acceptable. Jul 15, 2009 at 19:51
  • While I generally agree with this, there may be some very rare cases where manual escaping may be necessary. For example, while creating XML documentation using Roslyn.
    – svick
    May 1, 2012 at 15:56
  • @svick: why not create the XML using LINQ to XML, and then use .ToString()? May 1, 2012 at 16:37
  • @JohnSaunders, because Roslyn has its own set of XML classes, like XmlElementSyntax. And it's also complicated by the fact that you need to generate the /// too. And I can't generate each line as a separate XObject, because that wouldn't work for multiline tags.
    – svick
    May 1, 2012 at 17:07
  • 1
    @svick: so generate the xml, all on one line, stick /// in front of it, then reformat the code. Not a huge big deal, and certainly very much a corner case. If absolutely necessary, I'm sure you could create a custom XmlWriter to do line breaks and whitespace the way you'd like, but placing /// in front of new lines. Alternatively, use an XSLT to pretty-print the XML. But in any case, XML should still be generated by an XML API. May 1, 2012 at 19:41
10

And if you want, like me when I found this question, to escape XML node names, like for example when reading from an XML serialization, use the easiest way:

XmlConvert.EncodeName(string nameToEscape)

It will also escape spaces and any non-valid characters for XML elements.

http://msdn.microsoft.com/en-us/library/system.security.securityelement.escape%28VS.80%29.aspx

5
  • I think, based on the questions, that they just want inner text. Your solution will work, but is somewhat overkill as it's intended to also handle things like element and attribute names.\ Mar 19, 2014 at 16:20
  • 1
    Well I got here trying to escape node names anything and thought my findings could help anybody in the future. I also don't see what's the "overkill" but it's OK. ;) Mar 20, 2014 at 10:30
  • Oh, it's useful information. :) I just figured I'd point out that one of the reasons you might not have gotten upvoted was because people might feel that you're not answering the question at hand. Mar 20, 2014 at 11:35
  • The link leads to docs for SecurityElement.Escape(String), was this intentional? XmlConvert.EncodeName(String) has it's own page. I know it has been a few years since this was asked, but how do I know which one to use? Don't they do the same thing but in different ways?
    – micnil
    Sep 17, 2018 at 12:31
  • @CharlieBrown: Maybe you also want to create a separate question out of it and answer it, so people can better find it. Thanks for posting it! Oct 21, 2020 at 5:58
7

Another take based on John Skeet's answer that doesn't return the tags:

void Main()
{
    XmlString("Brackets & stuff <> and \"quotes\"").Dump();
}

public string XmlString(string text)
{
    return new XElement("t", text).LastNode.ToString();
} 

This returns just the value passed in, in XML encoded format:

Brackets &amp; stuff &lt;&gt; and "quotes"
5

WARNING: Necromancing

Still Darin Dimitrov's answer + System.Security.SecurityElement.Escape(string s) isn't complete.

In XML 1.1, the simplest and safest way is to just encode EVERYTHING.
Like &#09; for \t.
It isn't supported at all in XML 1.0.
For XML 1.0, one possible workaround is to base-64 encode the text containing the character(s).

//string EncodedXml = SpecialXmlEscape("привет мир");
//Console.WriteLine(EncodedXml);
//string DecodedXml = XmlUnescape(EncodedXml);
//Console.WriteLine(DecodedXml);
public static string SpecialXmlEscape(string input)
{
    //string content = System.Xml.XmlConvert.EncodeName("\t");
    //string content = System.Security.SecurityElement.Escape("\t");
    //string strDelimiter = System.Web.HttpUtility.HtmlEncode("\t"); // XmlEscape("\t"); //XmlDecode("&#09;");
    //strDelimiter = XmlUnescape("&#59;");
    //Console.WriteLine(strDelimiter);
    //Console.WriteLine(string.Format("&#{0};", (int)';'));
    //Console.WriteLine(System.Text.Encoding.ASCII.HeaderName);
    //Console.WriteLine(System.Text.Encoding.UTF8.HeaderName);


    string strXmlText = "";

    if (string.IsNullOrEmpty(input))
        return input;


    System.Text.StringBuilder sb = new StringBuilder();

    for (int i = 0; i < input.Length; ++i)
    {
        sb.AppendFormat("&#{0};", (int)input[i]);
    }

    strXmlText = sb.ToString();
    sb.Clear();
    sb = null;

    return strXmlText;
} // End Function SpecialXmlEscape

XML 1.0:

public static string Base64Encode(string plainText)
{
    var plainTextBytes = System.Text.Encoding.UTF8.GetBytes(plainText);
    return System.Convert.ToBase64String(plainTextBytes);
}

public static string Base64Decode(string base64EncodedData)
{
    var base64EncodedBytes = System.Convert.FromBase64String(base64EncodedData);
    return System.Text.Encoding.UTF8.GetString(base64EncodedBytes);
}
2
  • So in XML 1.1, how do you escape everything? May 16, 2015 at 1:28
  • @Philip Pittle: See SpecialXmlEscape Dec 10, 2015 at 12:57
4

Following functions will do the work. Didn't test against XmlDocument, but I guess this is much faster.

using System.IO;
using System.Xml;

public static string XmlEncode(string value)
{
    var settings = new XmlWriterSettings 
    {
        ConformanceLevel = ConformanceLevel.Fragment
    };

    var builder = new StringBuilder();

    using (var writer = XmlWriter.Create(builder, settings))
        writer.WriteString(value);

    return builder.ToString();
}

public static string XmlDecode(string xmlEncodedValue)
{
    if (xmlEncodedValue.Length == 0)
        return xmlEncodedValue;

    var settings = new XmlReaderSettings
    {
        ConformanceLevel = ConformanceLevel.Fragment
    };

    using var stringReader = new StringReader(xmlEncodedValue);
    using var xmlReader = XmlReader.Create(stringReader, settings);
    if (!xmlReader.Read() || xmlReader.NodeType != XmlNodeType.Text)
    {
        throw new ArgumentException(
            "The specified value does not constitute an XML-encoded string.",
            nameof(xmlEncodedValue));
    }

    return xmlReader.Value;
}
2

Using a third-party library (Newtonsoft.Json) as alternative:

public static string XmlEscape(string unescaped)
{
    if (unescaped == null) return null;
    return JsonConvert.SerializeObject(unescaped); ;
}

public static string XmlUnescape(string escaped)
{
    if (escaped == null) return null;
    return JsonConvert.DeserializeObject(escaped, typeof(string)).ToString();
}

Examples of escaped string:

a<b ==> "a&lt;b"

<foo></foo> ==> "foo&gt;&lt;/foo&gt;"

NOTE: In newer versions, the code written above may not work with escaping, so you need to specify how the strings will be escaped:

public static string XmlEscape(string unescaped)
{
    if (unescaped == null) return null;
    return JsonConvert.SerializeObject(unescaped, new JsonSerializerSettings()
    {
        StringEscapeHandling = StringEscapeHandling.EscapeHtml
    });
}

Examples of escaped string:

a<b ==> "a\u003cb"

<foo></foo> ==> "\u003cfoo\u003e\u003c/foo\u003e"

5
  • This generates JSON not XML? Dec 10, 2020 at 4:59
  • This generates just escaped string. In fact, these functions can be used to "escape" and "unescape" the input string. Input string for escaping might be for ex. HTML or XML. I've changed function name to make it more correct.
    – abberdeen
    Dec 10, 2020 at 20:03
  • But XML should not have quotes around the string, which this function produces. Also, not all characters are escaped in XML compatible form. For example tab gets formatted as "\t". Dec 11, 2020 at 5:39
  • Also, can you please point to a XML parsing function which is able to read the characters in the form of \uxxxx ? Dec 11, 2020 at 5:43
  • This is working well for JSON, not XML. XML has more special characters like & that will be missed
    – nrofis
    Aug 11, 2021 at 12:56
1

SecurityElementEscape does this job for you

Use this method to replace invalid characters in a string before using the string in a SecurityElement. If invalid characters are used in a SecurityElement without being escaped, an ArgumentException is thrown.

The following table shows the invalid XML characters and their escaped equivalents.

enter image description here

https://learn.microsoft.com/en-us/dotnet/api/system.security.securityelement.escape?view=net-5.0

1

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.