Feeds guide
RSS HTML: CDATA or escaped text?
Publish HTML-shaped RSS descriptions without producing child markup, double-escaping entities, or breaking on an unexpected CDATA terminator.
7 min read · Updated 2026-08-21
The short answer
RSS descriptions are XML character data, so HTML-shaped content must be entity-escaped or placed in CDATA. Both produce text for the feed consumer; neither turns the HTML into RSS child elements. Prefer a real serializer, sanitize the HTML separately, and handle ]]> before choosing CDATA.Keep embedded HTML as character data
A raw <p> inside description becomes an XML element, not a string containing HTML. Escape its angle brackets or wrap the value in CDATA so the RSS parser returns text that a reader may later interpret as HTML.
<description><p>New &amp; improved</p></description><description><![CDATA[<p>New & improved</p>]]></description>Separate XML escaping from HTML sanitization
XML escaping makes the feed well-formed; it does not make embedded HTML safe. Sanitize allowed tags, attributes, and URL schemes before serialization, then encode the sanitized string for its XML context exactly once.
- Sanitize HTML before wrapping it in CDATA.
- Escape once at the XML serialization boundary.
- Keep plain text and HTML-bearing fields distinct in the content model.
- Test how target readers render relative links, images, and unsupported tags.
Choose the spelling your pipeline can preserve
Escaped text works in every text and attribute context and has no terminator edge case. CDATA is more readable for markup-heavy bodies but needs splitting when content contains ]]>. A parse-and-reserialize step may switch between the two without changing the value.
Prove the fix
- Validate the feedCheck the serialized response rather than the pre-escaped application value.
- Compare source spellingsChoose based on context, readability, and arbitrary-input handling.
- Escape a sample valueConfirm the exact XML spelling for the sanitized HTML string.
Related guides
- How to fix CDATA that contains ]]>Handle the CDATA terminator without truncating content, understand why CDATA cannot nest, and choose normal escaping when input is arbitrary.
- How to fix an RSS pubDateWrite RSS 2.0 publication dates in the expected RFC 822 family, preserve the real instant, and catch values feed readers silently ignore.
Get started
Bring order to the XML your team can't afford to ignore.
Create a free account and get a private workspace to search, validate, diff, and monitor your XML feeds, sitemaps, schemas, and vendor integrations.