Escaping special characters in xml

I have an XML file that has answers to a quiz done in Flash
and AS 1.0. One of the questions has answers in the form of ">
1" "< 1". This particular answer is referring to less than a
year or more than a year. The < doesn't show up at all in the
answers screen, probably because it needs to be escaped. Is that
possible or do I need to spell out the answer. BTW, is in French
which I don't speak so i am opting for keeping the answers as they
are, and work around the problem by escaping, had it been Spanish
or English I would rewrite the answers comfortably. Any suggestions
would be greatly appreciated. Encoding for the XML file is xml
version="1.0" encoding="utf-8"

<
&
>
'
"

Similar Messages

How to remove special characters in xml

Dear friends,
How to remove the special character from the xml. I am placing the xml file and fetching through file adapter.
The problem is when there is any special character in xml. i am not able to pass to target system smoothly.
Customer asking schedule the file adapter in order to do that the source xml should not have any special charatcters
How to acheive this friends,
Thanx in advance.
Take care

Hi Karthik,
Go throgh the following links how to handle special character
https://www.sdn.sap.com/irj/scn/weblogs?blog=/pub/wlg/9420 [original link is broken] [original link is broken] [original link is broken]
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/502991a2-45d9-2910-d99f-8aba5d79fb42
Restricting special characters in XML within XI..
Regards
Goli Sridhar

SQL Injections and XSS - Escaping Special Characters

Hi, hope someone can help in regards to security and SQL Injections and XSS.
We are using APEX 4.0.2 on Oracle 11.2.0.2.
1. It seems the special characters we have entered into normal 'Text Items' 'Text Areas' etc are not being escaped (ie <,>,&, '). If I enter them into the field (ie Surname) they are saved as is into session state and the database - no escaping. Am I missing something such as an environment setting as I thought the "smart" oracle escaping rules would cater for this.
Surely I don't have to manually do each of then.
Just to confirm, am I looking in the correct places to assess if the characters are escaped or not - ie should they show as '&<>' in session state and/or the database ?
2. Also, for the Oracle procedures such as '‘wwv_flow.accept’ , ‘wwv_flow.show’ , 'wwv_flow_utilities.show_as_popup_calendar' - do these escape special characters. If not, then they must be vulnerable to SQL Injections attacks.
Thx
Nigel

Recx Ltd wrote:
Just to pitch in, escaping values internally (either in the database or session state) is extremely problematic. Data searches, string comparison, reporting and double escaping are all areas which suffer badly when you do this.
Stripping characters on input can also cause problems if not considered within the context of the application. Names such as "O'Niel", statistical output such as "n < 300", fields containing deliberate HTML markup can be annoying to debug. In certain situations stripping is totally ineffective and may still lead to cross-site scripting.
Apex applications that share the database with other applications will also be affected.
The database should contain 'raw' unfettered data and output should be escaped properly, as Joel said, at render time. Either with Apex attributes or using PLSQL functions such as htf.escape_sc() as and when required.Do not needlessly resurrect old threads. After a couple of months watches expire and the original posters are not alerted to the presence of your follow-up.
Shameless plug: If you are in the game of needing to produce secure Apex code, you should get in touch.This crosses the line into spam: it violates the OTN Terms of Use—see 6(j).
Promotional posts like this are liable to be removed by the moderators.

Special characters in XML barcode content

Hello,
I made a barcoded form with a custom script that creates a custom XML as barcode content.
The decoding happens well when the user write plain text in the text fields, but whenever it inputs some special characters (for XML syntax), like ",<,>,=,etc... the content of barcode it is decoded as:
<barcode>
<!CDATA[... true content ...]>
</barcode>
how can I handle this situation?
I have to handle what the user writes or I have to change the decode activity?
Thank you very much for your support!
Fabio

Steve,
I have already encoded decode operation in UTF-8. In form level, because it is an acrobat form, no option to choose the encoding as in LC Designer. In further tests, if I change the extractToXML output to XDP instead of XFDF, then I will receive data rather than &# sequence. It is strange. Don't understand why XDP and XFDF would give out different encoding.
Tim

Special characters in XML (UTF8, escapes etc)

This may seem like a simple problem, but I'm kind of a slow learner, so any help would be appreciated.
I'm generating XML output via ordinary PL/SQL procedures i.e. not using the Oracle XSQL stuff. The data is built up into a XML document, which will be parsed within the server, then passed out to a client, probably as a CLOB.
The data may contain "special" characters such as "<&>" and so on. Is there an existing function to translate these into an "XML-safe" form within the text, or do I need to trap and translate them individually?
Also, the database may contain foreign characters e.g. Thai or Chinese. Will this be handled transparently by my XML-extraction stuff - which just selects the data from the tables and writes it to a CLOB inside XML tags - or do I have to do something to make sure the XML comes out in a safe UTF format?
Thanks,
Chris

use & instead of &
see http://www.w3.org/TR/2000/REC-xml-20001006#syntax

How to escape special characters in Simple Transformation

Hi Experts,
I have got a problem to get a well formed xml document from the below simple transformation. The content of maktx contains
special characters like & <, which are not allowed in a well formed XML-Document. But the result of the Simple Transformation
contains this charcters even after the transformation as you can the in the result below. Has anyone a hint how to escape the
characters included in the maktx.
The transformation for maktx, should be something like
Before: Material & < TEST
After: Material &amp &lt TEST
Report wihich calls the simple transformation
types:
BEGIN OF t_mat,
   matnr type matnr,
   maktx type maktx,
end of t_mat.
Data:
mat type t_mat,
xml_stream type xstring.
START-OF-SELECTION.
mat-matnr = '4711'.
mat-maktx = 'Material & < Test'.
CALL TRANSFORMATION ztest_st2
        SOURCE mat = mat
        RESULT XML xml_stream.
CALL FUNCTION 'DISPLAY_XML_STRING'
EXPORTING xml_string = xml_stream.
Simple Transformation
<?sap.transform simple?>
<tt:transform xmlns:tt="http://www.sap.com/transformation-templates">
<tt:root name="MAT"/>
<tt:template>
    <Leistungsschild>
        <CHARACT> MATNR </CHARACT>
        <CHARACT_DESCR> Materialnummer </CHARACT_DESCR>
        <VALUE tt:value-ref="MAT.MATNR"/>
        <CHARACT> MAKTX </CHARACT>
        <CHARACT_DESCR> Materialkurztext </CHARACT_DESCR>
        <VALUE tt:value-ref="MAT.MAKTX" />
    </Leistungsschild>
</tt:template>
</tt:transform>
RESULT
<?xml version="1.0" encoding="utf-8" ?>
<Leistungsschild>
<CHARACT>MATNR</CHARACT>
<CHARACT_DESCR>Materialnummer</CHARACT_DESCR>
<VALUE>4711</VALUE>
<CHARACT>MAKTX</CHARACT>
<CHARACT_DESCR>Materialkurztext</CHARACT_DESCR>
<VALUE>Material & < Test</VALUE>   </Leistungsschild>

Hi Sandra,
First of all thaks for your quick answer to my problem.
I see what you mean and get the same result, if I am using data-type string instead of xstring. But the recommendation in the XML-Books of SAP is to use XSTRING to save memory and circumflex problems between Codepages, when writing the XML-Stream to a filesystem.
As you can see in the code abvoe I am using a SAP-FM to display the XML-Stream and this FM works only with XSTRING´s,
that is one reason why I don´t understand that it displays it in the wrong way.
Even the Debugger shows me for the XSTRING the wrong result. Does all that mean that the escaping will not be applyed if you are working with XSTING´s??

Replacing special characters from xml document/text inside element

Hi
Is there any way to replace the xml codes to special characters inside an entire xml document/ for a text in element.
I want to get the xml codes to get replaced to respective special character(for any special character)
Please see the sample xml xml element below
<Details>Advance is applicable only for < 1000. This is mentioned in Seller's document</Details>
Thanks in advance .. any help will be highly appreciated.

So, just to be sure I understand correctly, you want this :
<Details>Advance is applicable only for < 1000. This is mentioned in Seller's document</Details>
to be converted to :
<Details>Advance is applicable only for < 1000. This is mentioned in Seller's document</Details>
If so, I'll say again : the resulting XML document will be invalid.
Extensible Markup Language (XML) 1.0 (Fifth Edition)
The ampersand character (&) and the left angle bracket (<) MUST NOT appear in their literal form, except when used as markup delimiters, or within a comment, a processing instruction, or a CDATA section. If they are needed elsewhere, they MUST be escaped using either numeric character references or the strings " & " and " < " respectively. The right angle bracket (>) may be represented using the string " > ", and MUST, for compatibility, be escaped using either " > " or a character reference when it appears in the string " ]]> " in content, when that string is not marking the end of a CDATA section.
Ask whoever "they" are why they would want to work with not wellformed XML.

Handling special characters in XML

Hi,
I am using Oracle 10g 'XMLType' datatype to store XML files. Before storing I parse the XML document using Java Xerces Parser. If it parses successfuly, then I perform some business rule execution based on XML file which was parsed. So till this stage there is no problems. But when XML file contains some special characters like copy-paste of some description from MS-Word document into XML tags, then Xerces parser will parse such characters with out any exceptions, but while inserting XML document, Oracle database just throws exception saying unable to handle special characters.. So how to avoid such exceptions or silent such exceptions with any specific settings respect to XMLType datatype in 10g DB.
Please advice!
Arvind Patil - IN

Monica--
In XI 2.0, we've noticed a number of issues processing special characters, primarily caused by the version of JCO that we're running. It sounds like SAP has spent some time in the past few months focusing on these errors, so make sure you're on the most recent patchlevels of all your middleware components, including any of the middleware libraries that BC uses. In XI, we had to update the 3 files that make up the RFC library and JCO library. SDM couldn't update the libraries for us -- we had to manually move the files to the right place.
Escaped XML characters like "&" """ """ were fixed as of JCO 2.0.10 (the current patchlevel on AIX/UNIX), the special character "'" is fixed in the next release, JCO 2.0.11, due out in a few weeks (hotfixes are available). I don't know the equivalent versions on other platforms. By default, XI 2.0 appears to have shipped with JCO 2.0.5. I would expect many XI 3.0 users to also be affected.
This may or may not apply to BC, because I don't know what BC uses to talk to SAP under the covers.
--Dan King
Capgemini

Parsing Special Characters in XML

Hi,
I have an incoming XML snippet that has the special characters already escaped.
If the Title is something like kkkkk ?& [] ]]> XML comes back escaped for & and >
<title><kkkkk ? & [] ]]></title>
Now I would like parse this ESCAPED Title correctly that should result in
<![CDATA[kkkkk ?& [] ]]>]]>
BUT INSTEAD I just get
<![CDATA[>]]>
What is it that I am missing?
Thank you so much.
Meena

A CDATA section can not contain the string "]]>" because that string is used to identify the end of CDATA section. Try removing the additional "]]>" and try if it works good for the rest of the data within the CDATA section.

Escape special characters for OData response

Hi all,
I'm facing a problem on HTTP response when some special characters are in my entity fields.
For example I've got a Edm.String field which has characters like ###, ", < (two number signs ## are ok, but three invoke an error)
When I set output format to xml via URI parameter $format=xml, I get following error:
<message xml:lang="en">In the context of Data Services an unknown internal server error occured</message>
Exception /IWCOR/CX_DS_INTERNAL_ERROR in class /IWCOR/CL_DS_EP_WRITER_OUTPUT method /IWCOR/IF_DS_EP_WRITER_OUTPUT~WRITE and Line 39
If I use JSON as output format, HTTP response code is 200!!, but payload just ends on the character which cannot be interpreted:
(ABAP)-JSON generator can handle double quotes much better than XML format:
How can I escape these output strings, without adding chars which will appear in response payload?
Thanks,
Steffen

Hi Uwe & Ron,
thanks for your ideas, but maybe we're not talking about binary data?! This field is an example from TADIR table.
OData entity definition for this field:
Versid
Edm.String
0
0
20
ABAP field definition:
Data Type        CHAR - Character String
No. Characters       20
Decimal Places        0
Output Length        20
Convers. Routine    <empty>
Uwe did you mean another debugger view?
SE16 output for this line:
What if I want to store and receive data with these special chars like ####, ", <, >,... in a ABAP char field (respective OData Edm.String)?
Thanks,
Steffen

Special characters in XML structure when prepared using String

Hi,
   I am preparing an XML structure using 'String'. I print the prepared XML structure in the server log. Issue is that I am seeing extra characters([[ and ]]) that I am not printing.
Please let me know how to get rid of those.
Code Excerpt
        String xmlHeader = "<?xml version=\"1.0\" encoding=\"utf-8\" ?>";
        String lsb_xmlcon = xmlHeader;
        logger.info("ReqXMLString Process 1 --->" + lsb_xmlcon);
        lsb_xmlcon = lsb_xmlcon +("\n");
        logger.info("ReqXMLString Process 1.1 --->" + lsb_xmlcon);
        lsb_xmlcon = lsb_xmlcon +("<REQUEST>");
        lsb_xmlcon = lsb_xmlcon +("\n");
        logger.info("ReqXMLString Process 1.2 --->" + lsb_xmlcon);
Log
ReqXMLString Process 1 ---><?xml version="1.0" encoding="utf-8" ?>
ReqXMLString Process 1.1 ---><?xml version="1.0" encoding="utf-8" ?>[[
ReqXMLString Process 1.2 ---><?xml version="1.0" encoding="utf-8" ?>[[
<REQUEST>
Thanks,
Message was edited by: 996913
This issue is observed only while running the code in server, not from Jdev.
When we append the additional tags without new line character, "\n", there are no extra characters being added. Also, in other case also. where we used "Marshaller" to prepare the XML, we have seen this issue.
After we set the below property to false, we got rid of the extra characters.
                        jaxbMarshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, false);
Apparently the insertion of new line when the code runs on server(Weblogic 10.3.6.0) is creating the issue.
Please let me know if anyone has come across a similar scenario.
Thanks,

I am building this XML in a servlet so ,right, DOM does process XML (even though a valid HTML file can be loaded into a DOM object) but if you build XML using DOM then write the XML out using PrintWriter and Transformer objects this will cause the XML to print out in your browser. If you view source on this XML you will see that the DOM object has translated all special characters to there &xxxx; equivalent. For a example: when the string (I know "cool" java) gets loaded into a attribute using the DOM object then wrote back out it looks like (I know &xxx;cool&xxx; java) if you view the source in your browser. This is what it should do, but the DOM object is not change the � to the "&xxxxx;". This servlet is acting as a gateway between a Java API and a windows asp. The asp will call the servlet expecting to get XML back and load it directly into a DOM object. When the windows DOM object gets the xml that I am returning in this servlet is throws a exception "invalid character" because the � was not translated to &xxxx; like the other characters were. According to the book HTML 4 in 24 hours (and other references) the eacute; or #233; are how you say "�" in HTML or XML. How do you say it?

Special characters in xml

Hello!
I am trying to generate XML from database by using fnd_file package. Trouble is that application NLS_LANG is not set to UTF8 and it should stay so due to the fact that a lot of custom reports written using Oracle Reports may not display special characters correctly. So i have problem with characters like 'ö','ļ'.... Is there a way to set encoding for only XML output? Also in my last efforts the output XML for some reason is concatenating a strange square shaped character into the end of file. Has anybody seen similar problem and maybe solved it?
Thanks
Aleksei

Refer to
http://java.sun.com/j2ee/1.4/docs/tutorial/doc/JAXPSAX6.html

Special Characters in XML Publisher PDF Output

Hi,
I'm printing "Long Text" in report output in every line based on tab.
Report output is having special characters like \n.
I was using below to print in next line, any suggestions for removing \n.
Below is what was happening:
===================
RDF:
=====
lv_notes := replace(:CF_LONG_TEXT_DESC, chr(9), ' ') ;
lv_notes1 := replace(lv_notes, chr(10), ' ') ;
lv_notes2 := replace(lv_notes1, chr(13), ' ') ;
XML
===
<CF_LONG_TEXT_desc>
Initial Billing Amount: $549,180.00 \n \n Computation: \n a) Estimated Number of Full-Time Students: 12,000 \n
b) Estimated Number of Calendar Days: 113 \n
c) Calendar Date (From - To): 1/18/2011 - 5/10/2011 \n
d) Multiply by: $0.81 \n
e) Estimated Total Costs: $1,098,360.00 \n
f) Initial Billing Amount represents 50% of Estimated Total Costs. \n
\n \n
If you have questions about your invoice please contact Darud Akbar at (312) 681-2724.
</CF_LONG_TEXT_desc>
PDF Output
==========
Initial Billing Amount: $549,180.00 \n \n Computation: \n a) Estimated Number of Full-Time Students: 12,000 \n
b) Estimated Number of Calendar Days: 113 \n
c) Calendar Date (From - To): 1/18/2011 - 5/10/2011 \n
d) Multiply by: $0.81 \n
e) Estimated Total Costs: $1,098,360.00 \n
f) Initial Billing Amount represents 50% of Estimated Total Costs. \n
\n \n
If you have questions about your invoice please contact Darud Akbar at (312) 681-2724.
Thanks.

>
Initial Value
=======
<?CF_LONG_TEXT_desc?>
Changed to (Below gives me error)
========
<?<xsl:value-of select="translate(CF_LONG_TEXT_desc,'\n','')"/>?>
Changed to (Below doesn't fetch data)
========
<xsl:value-of select="translate(CF_LONG_TEXT_desc,'\n','')"/>
>
must be in field as
<xsl:value-of select="translate(CF_LONG_TEXT_desc,'\n','')"/>

Special characters in XML document

I have a Flash file saved as version 8 with the following script calling an xml file:
//init TextArea component
myText.html = true;
myText.wordWrap = false;
myText.multiline = false;
myText.label.condenseWhite=true;
//load in XML
xml = new XML();
xml.ignoreWhite = true;
xml.onLoad = function(success){
    if(success){
        myText.text = xml;
xml.load("titletext.xml");
My xml file contains the following:
<?xml version="1.0" encoding="iso-8859-1"?>
<![CDATA[Smith's dog & cat are "crazy"]]>
When posted online my flash file displays the encoding tag in the xml file.
AND the apostrophe, ampersand and quote marks display as html code instead of the actual character.
I can take the encoding tag out of the xml file but my characters still don't display correctly.
My dynamic text field in flash (myText) does have special characters embedded, plus I have them entered manually in the field for 'include these characters'.
Does anyone have suggestions for me?
You can view this test file at http://wilddezign.com/preshomes_name2.html
TIA

Perhaps you need a slightly different approach to loading the XML. Instead of loading the entire XML file, what if you loaded only the child you were looking for? This is what I usually do:
var xml:XML = new XML();
xml.ignoreWhite = true;
xml.load("some.xml");
xml.onLoad = parse;
function parse(success){
if (success){
root = xml.firstChild;
_global.numberItems = root.attributes.items;
itemNode = root.firstChild;
var i:Number = 0;
while(itemNode != null){
     myText.text = itemNode.attributes.description;
     itemNode = itemNode.nextSibling;
     i++;
else {
trace("XML Bad!!");
And your XML would be structured like this:
<?xml version="1.0" encoding="utf-8"?>
<sample>
<item description="This is the text that I want to appear on this MC!" />
</sample>

Special characters in XML built using the DOM object

I am using the DOM object to build xml but I am having problems with special characters. I have a Element object that I create attributes in. Most special characters like the &, ", or ' are translated for me (amp; quot;, acute; put a & in front of those, if I do it here the browser will translate them into the logical character) but I am having a problem with the � character. The DOM object does not translate this. If I do it my self to(eacute; same here add a & in front) before adding the string to the attribute then the DOM object translates it to (amp;eacute; add a & in front of the amp; not in front of the eacute;). As you can see the DOM object translates the & instead of recognizing that it is a HTML character. Can anyone give me a hand?

I am building this XML in a servlet so ,right, DOM does process XML (even though a valid HTML file can be loaded into a DOM object) but if you build XML using DOM then write the XML out using PrintWriter and Transformer objects this will cause the XML to print out in your browser. If you view source on this XML you will see that the DOM object has translated all special characters to there &xxxx; equivalent. For a example: when the string (I know "cool" java) gets loaded into a attribute using the DOM object then wrote back out it looks like (I know &xxx;cool&xxx; java) if you view the source in your browser. This is what it should do, but the DOM object is not change the � to the "&xxxxx;". This servlet is acting as a gateway between a Java API and a windows asp. The asp will call the servlet expecting to get XML back and load it directly into a DOM object. When the windows DOM object gets the xml that I am returning in this servlet is throws a exception "invalid character" because the � was not translated to &xxxx; like the other characters were. According to the book HTML 4 in 24 hours (and other references) the eacute; or #233; are how you say "�" in HTML or XML. How do you say it?

Escaping special characters in xml

Similar Messages

Maybe you are looking for