XML Escape and Unescape

// XML defines exactly five named entities. A single regex pass avoids the
// classic bug of replacing & after < and turning &lt; into &amp;lt;.
const ESCAPES = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&apos;' };

// Element content: & and < are mandatory, > only inside the sequence ]]>.
function escapeText(s) {
  return s.replace(/[&<]/g, (c) => ESCAPES[c]).replace(/]]>/g, ']]&gt;');
}

// Attribute value: escape the delimiter you are using, plus tab, newline and
// carriage return. Attribute-value normalisation turns a literal one of those
// into a plain space, so a reference is the only way to keep it.
function escapeAttribute(s) {
  return s
    .replace(/[&<"]/g, (c) => ESCAPES[c])
    .replace(/\t/g, '&#9;')
    .replace(/\n/g, '&#10;')
    .replace(/\r/g, '&#13;');
}

// The reverse. Note the deliberate absence of an HTML entity table: &nbsp; is
// undefined in XML, so leaving it alone is more honest than decoding it.
const NAMED = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" };

function unescapeXml(s) {
  return s.replace(/&(#x[0-9a-fA-F]+|#[0-9]+|[A-Za-z][A-Za-z0-9]*);/g, (whole, body) => {
    if (body[0] === '#') {
      const hex = body[1] === 'x';
      const cp = parseInt(hex ? body.slice(2) : body.slice(1), hex ? 16 : 10);
      return cp >= 0 && cp <= 0x10ffff ? String.fromCodePoint(cp) : whole;
    }
    return NAMED[body] !== undefined ? NAMED[body] : whole;
  });
}

from xml.sax.saxutils import escape, quoteattr, unescape
import re

# escape() handles & < > only and knows nothing about quotes. The > is not
# strictly required but it is harmless and covers the ]]> case for free.
text = escape('Terms & conditions <see clause 4>')
# Terms &amp; conditions &lt;see clause 4&gt;

# The two quote entities have to be supplied yourself.
FIVE = {'"': '&quot;', "'": '&apos;'}
text = escape(source, FIVE)

# quoteattr() returns the value WITH its delimiters, picking single quotes when
# the value contains a double quote, and turning tab, newline and carriage
# return into numeric references so normalisation cannot flatten them.
attr = quoteattr('say "hello" then stop')
# 'say "hello" then stop'   <- single-quoted, so the " needs no escape

# unescape() reverses & < > plus whatever mapping you pass. It does NOT decode
# numeric character references, so &#233; comes back unchanged. html.unescape()
# does decode them, but it also decodes &nbsp; and 250 other HTML names XML
# never defined, which silently rewrites your data. Do it explicitly instead:
def unescape_xml(s: str) -> str:
    s = unescape(s, {'&quot;': '"', '&apos;': "'"})
    return re.sub(
        r'&#(x[0-9a-fA-F]+|[0-9]+);',
        lambda m: chr(int(m.group(1)[1:], 16) if m.group(1)[0] == 'x' else int(m.group(1))),
        s,
    )

// The JDK has no public XML escaper for a bare string. Two right answers.

// 1. Let a writer do it. XMLStreamWriter escapes for the context it is
//    writing into, the only approach that gets attribute values right.
import javax.xml.stream.XMLOutputFactory;
import javax.xml.stream.XMLStreamWriter;

XMLStreamWriter w = XMLOutputFactory.newInstance().createXMLStreamWriter(out);
w.writeStartElement("note");
w.writeAttribute("href", "https://example.com/?a=1&b=2");  // escaped for you
w.writeCharacters("Terms & conditions <apply>");           // escaped for you
w.writeEndElement();
w.close();

// 2. Escape a standalone string with commons-text. Do NOT use commons-lang3's
//    deprecated StringEscapeUtils.escapeXml, which knew nothing about the
//    characters XML cannot represent.
import org.apache.commons.text.StringEscapeUtils;

String safe = StringEscapeUtils.escapeXml10("Terms & conditions <apply>");
// Terms &amp; conditions &lt;apply&gt;

// escapeXml10 does something its name does not advertise: it DELETES the
// characters XML 1.0 cannot hold (U+0001 to U+0008, U+000B, U+000C,
// U+000E to U+001F, unpaired surrogates) rather than escaping them, because
// no escape for them exists. escapeXml11 writes the control characters as
// numeric references instead, which is only legal if the document declares
// version="1.1", and it still drops U+0000 and unpaired surrogates.

String back = StringEscapeUtils.unescapeXml(safe);
// The five predefined entities plus decimal and hex character references.
// Names it does not know are left as written.

using System.Linq;
using System.Security;
using System.Xml;

// SecurityElement.Escape does the five predefined entities in one call:
// < > & " ' every time, a superset of what any single context needs.
string safe = SecurityElement.Escape("Terms & conditions <apply>");
// Terms &amp; conditions &lt;apply&gt;

// It does not remove the characters XML cannot carry, so check those yourself.
// XmlConvert.IsXmlChar implements the Char production from XML 1.0. Keep
// surrogates or astral characters (emoji, rarer CJK) are destroyed.
static string StripIllegal(string s) =>
    string.Concat(s.Where(c => XmlConvert.IsXmlChar(c) || char.IsSurrogate(c)));

// In practice prefer a writer. It escapes for the context and throws on a
// character the document cannot hold, instead of producing a file that fails
// to parse somewhere downstream.
var settings = new XmlWriterSettings { Indent = true, CheckCharacters = true };
using var writer = XmlWriter.Create(Console.Out, settings);
writer.WriteStartElement("note");
writer.WriteAttributeString("href", "https://example.com/?a=1&b=2");
writer.WriteString("Terms & conditions <apply>");
writer.WriteEndElement();

// There is no framework unescaper, and WebUtility.HtmlDecode is the wrong
// tool: it decodes &nbsp; and the rest of the HTML set. Read a fragment
// instead, which decodes exactly what XML defines and nothing else.
static string Unescape(string escaped)
{
    var rs = new XmlReaderSettings
    {
        DtdProcessing = DtdProcessing.Prohibit,
        XmlResolver = null,
    };
    using var r = XmlReader.Create(new StringReader("<r>" + escaped + "</r>"), rs);
    r.ReadToFollowing("r");
    return r.ReadElementContentAsString();
}

<?php
// ENT_XML1 is the flag that matters and the one everybody omits. Without it
// you get the HTML entity table: an apostrophe becomes &#039; (harmless), and
// with ENT_HTML5 you can get names XML will reject outright.
$safe = htmlspecialchars(
    $text,
    ENT_XML1 | ENT_QUOTES | ENT_SUBSTITUTE,
    'UTF-8'
);
// & < > " ' become &amp; &lt; &gt; &quot; &apos;
//
// ENT_SUBSTITUTE replaces invalid UTF-8 with U+FFFD. Before PHP 8.1 the
// default was to return an empty string on invalid input, which is very easy
// to miss in a feed generator fed by a legacy database.

$back = html_entity_decode($safe, ENT_XML1 | ENT_QUOTES, 'UTF-8');
// With ENT_XML1 this decodes the five predefined entities and numeric
// character references and leaves &nbsp; alone. Drop the flag and it decodes
// &nbsp; into U+00A0, silently rewriting your data.

// Building a document rather than a string: DOMDocument escapes on save and
// rejects characters XML cannot represent, which htmlspecialchars passes
// straight through.
$doc = new DOMDocument('1.0', 'UTF-8');
$note = $doc->createElement('note');
$note->appendChild($doc->createTextNode($text));
$doc->appendChild($note);
echo $doc->saveXML();