Question

I’m generating an XML document from a PHP script and I need to escape the XML special characters.
I know the list of characters that should be escaped; but what is the correct way to do it?

Should the characters be escaped just with backslash (\’) or what is the proper way?
Is there any built-in PHP function that can handle this for me?

Answer 1

Use the DOM classes to generate your whole XML document. It will handle encodings and decodings that we don’t even want to care about.

---

Edit: This was criticized by @Tchalvak:

The DOM object creates a full XML document, it doesn’t easily lend itself to just encoding a string on it’s own.

Which is wrong, DOMDocument can properly output just a fragment not the whole document:

$doc->saveXML($fragment);

which gives:

Test &amp; <b> and encode </b> :)
Test &amp;amp; &lt;b&gt; and encode &lt;/b&gt; :)

as in:

$doc = new DOMDocument();
$fragment = $doc->createDocumentFragment();

// adding XML verbatim:
$xml = "Test &amp; <b> and encode </b> :)\n";
$fragment->appendXML($xml);

// adding text:
$text = $xml;
$fragment->appendChild($doc->createTextNode($text));

// output the result
echo $doc->saveXML($fragment);

See Demo