C# Shiznit - Escape XML string characters in C#

home

dispatch

archive

downloads

contact

admin

Escape XML string characters in C#

posted on Thursday, July 12, 2007 by bobby @ 1:57 pm

35 comments

I searched long and hard (that's what she said!) for a native .NET method for escaping special characters in text and didn't get very far. Sure, there's only like 5 special characters, and 5 Replace() calls would probably do the trick, but I'm sure there's got to be something built-in.

To much relief, I've discovered a native method, hidden away in the bowels of the SecurityElement class. Yes, that's right - SecurityElement.Escape(string s) will escape your string and make it XML safe.

Safety first.

Learn yourself here:
http://msdn2.microsoft.com/en-us/library/system.security.securityelement.escape(VS.80).aspx

permalink | digg | del.icio.us

CommentsComments

Handy link... I've been able to get around the problem by using the XmlTextWriter class which does the escaping for me. Probably using the class you mentioned.

Heh. I posted (see website link) on this a bit ago after a similar revelation. Its funny sometimes how hidden the simple stuff seems until i suddenly "find it".

Nice find!

What would be the opposite of this class? I would like to have the XmlTextWriter actually write characters such as '<' and '>' or Is there a way to tell the XmlTextWriter to allow for these characters when writing an XML file?

What about while reading escape characters from XML file. I have a string which has "&" in it and it stored in an XML file. But when i try to read it I am getting error. Is there a way to avoid it?

Thank you. Nice find. It did save me some time!

Wow, this is such a useful method that I too am surprised that it does not exist in the XML namespace.

Thanks, saved me loads of work!

Doesn't escape everything... What about '#'?

Thanks for the great find. Now I'm using 3.5 Framework, so I just put it into an extension method like this:

Copy code to clipboard in IE or select code for Firefox

Copy code to clipboard in IE or select code for Firefox

using System;
using System.Security;
namespace MyExtensions
{
  public static class AtraxExtensions
  {
    public static string ToXmlString(this string s)
    {
      return SecurityElement.Escape(s);
    }
  }
}

System.XML;

XmlConvert.EncodeName(sting s)

for encoding names

http://msdn2.microsoft.com/en-us/library/35577sxd(VS.80).aspx

Thanks Tyler for the inspiration of extension methods. I took it overboard to write my own naive, brute-force escape/unescape of xml string data:
Copy code to clipboard in IE or select code for Firefox

namespace Company.ExtensionMethods
{
  public static class StringExtensions
  {
    public static string EscapeXml( this string s )
    {
      string xml = s;
      if ( !string.IsNullOrEmpty( xml ) )
      {
        // replace literal values with entities
        xml = xml.Replace( "&", "&amp;" );
        xml = xml.Replace( "&lt;", "&lt;" );
        xml = xml.Replace( "&gt;", "&gt;" );
        xml = xml.Replace( "\"", "&quot;" );
        xml = xml.Replace( "'", "&apos;" );
      }
      return xml;
    }

    public static string UnescapeXml( this string s )
    {
      string unxml = s;
      if ( !string.IsNullOrEmpty( unxml ) )
      {
        // replace entities with literal values
        unxml = unxml.Replace( "&apos;", "'" );
        unxml = unxml.Replace( "&quot;", "\"" );
        unxml = unxml.Replace( "&gt;", "&gt;" );
        unxml = unxml.Replace( "&lt;", "&lt;" );
        unxml = unxml.Replace( "&amp;", "&" );
      }
      return unxml;
    }
  }
}

Now I can take shortcuts like
string xmlData = "<oh & no>".EscapeXml( );
so that xmlData ends up with "<oh & no>".

Nice - extensions methods are teh r0x0r. I did the same thing w/ String.Format. Now it's

"blah blah {0} blah".Fmt(data);

thanks so much frinkfree - i used just part of that code and it's working beautifully. I'm not a c# programmer, so this is great. thanks again!

Nice - extensions methods are teh r0x0r. I did the same thing w/ String.Format. Now it's

Hi,

The above link has solved the problems to build xml file.

Thanks for sharing. Helped me a solve the problem at hand.

yes! safety first
:D

was googling for that, thanks

Beware of XmlConvert.EncodeName() ! It doesn't do what you think it does.

It encodes XML *names* not entity data. So "1235" gets encoded as "_x0031_235" or somesuch nonsense.

pls help me in the following:

string txt = "dt '0'"; //note that there are 2 Quotes before and after the 0

string SQL = "Insert into Tabl(no, Qry) values('1','" + txt + "');";

// when i tried to execute the above SQL statement it Displayed an Error
// saying that incorrect syntax,.. due to the Quote before and after the 0,.
// but i want to save the txt into the Column along with the Quote,.
//what should i Do ??

Pls help me

In answer to Pradeep,

Never build a SQL query using string concatenation. Use Parameters. If you use SQL Server, use a SqlParameter.

When using string and XML data in SQL Server, you don't have to escape anything if your use parameters


SqlCommand command = new SqlCommand("Insert into Tabl(no, Qry) values(@No, @Qry);", yourConnectionObjectGoesHere);
command.Parameters.AddWithValue("@No", 1);
command.Parameters.AddWithValue("@Qry", txt);
command.ExecuteNonQuery();

Thanks for sharing. Helped me a solve the problem at hand.

It doesn't escape { } characters

I am using the following statement in my code:

XMLTextWriter.WriteAttributeString("url","https:\\one.com\first.ol&new=1");

Now in the resulting XML file, the url attribute has & amp; instead of the & character in the url which makes the url invalid.

< Attribute url="https:\\one.com\first.ol& amp;new=1" />

how do i avoid this default behaviur of XMLTextWriter class. Thanks in advance

Thanks!
I remembered that there is a native method like this, but couldn't find it.

I love you! Thanks very much, very useful - first programmer I've heard of with a sense of humour too!

You sir, are a god. I give you my thanks :)

I love you!

thanks

You can also use Regex.Escape() or Regex.UnEscape()

If anyone needs to use frinkfree's wonderfully simple escape/unescape method, make sure you fix the greater-than and less-than characters.

I'm pretty sure the message board escaped them when he posted the method to the board. How oddly ironic.

Genius. Irony at its best.

The thing is, that I personally like my variables aligned, i.e. their names beginning at the same column. For this I use Tabs. So, it would be nice, if your Add-In was capable of parsing field definitions correctly despite that Tabs, and not Spaces, is used as white-characters.

Nice found. No need to go for custom string.Replace or some other implementation. Really reduced work. Keep coming with new things.

for those that don;t have reflector, her is the code for SecurityElement.Escape

s_tagIllegalCharacters = new char[] { ' ', '<', '>' };
s_textIllegalCharacters = new char[] { '<', '>' };
s_valueIllegalCharacters = new char[] { '<', '>', '"' };
s_escapeStringPairs = new string[] { "<", "<", ">", ">", "\"", """, "'", "'", "&", "&" };
s_escapeChars = new char[] { '<', '>', '"', '\'', '&' };

public static string Escape(string str)
{
if (str == null)
{
return null;
}
StringBuilder builder = null;
int length = str.Length;
int startIndex = 0;
while (true)
{
int num2 = str.IndexOfAny(s_escapeChars, startIndex);
if (num2 == -1)
{
if (builder == null)
{
return str;
}
builder.Append(str, startIndex, length - startIndex);
return builder.ToString();
}
if (builder == null)
{
builder = new StringBuilder();
}
builder.Append(str, startIndex, num2 - startIndex);
builder.Append(GetEscapeSequence(str[num2]));
startIndex = num2 + 1;
}
}

Add a Comment

New Post Notification

Search Posts

Administrator Login
	Invalid login attempts are logged.
Username:
Password:

Contact Me

Name
Email
Message Ctrl + ↓/↑ to shorten/lengthen