对于标签和属性，转义字符是不同的。

标签:

 < &lt;
 > &gt; (only for compatibility, read below)
 & &amp;

属性:

" "
' '

从字符数据和标记:

The ampersand character (&) and the left angle bracket (<) must not appear in their literal form, except when used as markup delimiters, or within a comment, a processing instruction, or a CDATA section. If they are needed elsewhere, they must be escaped using either numeric character references or the strings " &amp; " and " &lt; " respectively. The right angle bracket (>) may be represented using the string " &gt; ", and must, for compatibility, be escaped using either " &gt; " or a character reference when it appears in the string " ]]> " in content, when that string is not marking the end of a CDATA section. To allow attribute values to contain both single and double quotes, the apostrophe or single-quote character (') may be represented as " &apos; ", and the double-quote character (") as " &quot; ".

这取决于上下文。对于内容，它是<和&，和]]>(尽管是一个由三个字符组成的字符串而不是一个字符)。

对于属性值，它是<、&、"和'。

对于CDATA，为[]>。

如果要处理字符数据而不是标记，则只有<和&需要转义:

2.4字符数据和标记

如果您使用适当的类或库，它们将为您进行转义。许多XML问题都是由字符串连接引起的。

XML转义字符

只有五种:

"   "
'   '
<   &lt;
>   &gt;
&   &amp;

转义字符取决于使用特殊字符的位置。

这些示例可以在W3C标记验证服务(W3C Markup Validation Service)中验证。

Text

安全的方法是转义文本中的所有五个字符。但是，"，'和>这三个字符在文本中不需要转义:

<?xml version="1.0"?>
<valid>"'></valid>

属性

安全的方法是转义属性中的所有五个字符。但是，>字符不需要在属性中转义:

<?xml version="1.0"?>
<valid attribute=">"/>

'字符在属性中不需要转义，如果引号是":

<?xml version="1.0"?>
<valid attribute="'"/>

同样，如果引号是'，属性中的"不需要转义:

<?xml version="1.0"?>
<valid attribute='"'/>

评论

注释中不能转义所有5个特殊字符:

<?xml version="1.0"?>
<valid>
<!-- "'<>& -->
</valid>

名为CDATA

所有5个特殊字符都不能在CDATA节中转义:

<?xml version="1.0"?>
<valid>
<![CDATA["'<>&]]>
</valid>

处理指令

在XML处理指令中，所有5个特殊字符都不能转义:

<?xml version="1.0"?>
<?process <"'&> ?>
<valid/>

XML vs. HTML

HTML有自己的一组转义码，可以覆盖更多的字符。

也许这将有所帮助:

XML和HTML字符实体引用列表:

在SGML、HTML和XML文档中 被称为字符的逻辑结构 数据和属性值由 字符序列，其中每个 性格可以直接表现出来 (代表自己)，或者可以 由一系列字符表示的 称为字符引用，其中 有两种类型:数字类型 字符引用和一个字符 实体引用。本文列出了 字符实体引用它 在HTML和XML文档中有效。

那篇文章列出了以下五个预定义的XML实体:

quot  "
amp   &
apos  '
lt    <
gt    >

对于标签和属性，转义字符是不同的。

标签:

 < &lt;
 > &gt; (only for compatibility, read below)
 & &amp;

属性:

" "
' '

从字符数据和标记:

The ampersand character (&) and the left angle bracket (<) must not appear in their literal form, except when used as markup delimiters, or within a comment, a processing instruction, or a CDATA section. If they are needed elsewhere, they must be escaped using either numeric character references or the strings " &amp; " and " &lt; " respectively. The right angle bracket (>) may be represented using the string " &gt; ", and must, for compatibility, be escaped using either " &gt; " or a character reference when it appears in the string " ]]> " in content, when that string is not marking the end of a CDATA section. To allow attribute values to contain both single and double quotes, the apostrophe or single-quote character (') may be represented as " &apos; ", and the double-quote character (") as " &quot; ".