Skip to main content

Search 400 pages — tools, formats, elements, namespaces, directory, comparisons, XPath, datatypes, glossary, parse errors, schema errors, use cases, guides, blog and product.

XML guide

How to fix CDATA that contains ]]>

Handle the CDATA terminator without truncating content, understand why CDATA cannot nest, and choose normal escaping when input is arbitrary.

6 min read · Updated 2026-08-21

The short answer

The character sequence ]]> closes a CDATA section and cannot appear inside its content. Split that sequence across adjacent CDATA sections or serialize the value as normal escaped character data. Never wrap arbitrary text in CDATA without handling the terminator first.

Recognize the terminator as XML syntax

CDATA changes how markup characters are spelled in source; it does not create a nestable container. The parser takes the first ]]> as the end, so anything after it is parsed as ordinary XML source.

Unsafe arbitrary payload
<code><![CDATA[const end = "]]>";]]></code>
Escaped character data
<code>const end = "]]&gt;";</code>

Split or escape the value deliberately

A serializer can split the forbidden sequence so the first CDATA section ends after the two closing brackets and the next begins with the greater-than sign. Ordinary escaping is simpler when the value does not contain large amounts of markup-like text.

  • Prefer escaped text for short fields and arbitrary user input.
  • Use a serializer that handles CDATA splitting rather than string concatenation.
  • Remember that CDATA is unavailable inside attribute values.
  • Do not expect nested CDATA markers to preserve themselves.

Test the parsed value, not only the source

Escaped text and CDATA normally produce the same character data. After changing the source spelling, parse the document and compare the resulting value to the original application string, including every bracket and greater-than sign.

Get started

Bring order to the XML your team can't afford to ignore.

Create a free account and get a private workspace to search, validate, diff, and monitor your XML feeds, sitemaps, schemas, and vendor integrations.