HowToCodePage

Whitespace, text and special characters

Indentation from the source document leaks into the output, and the standard fix for escaping is also the standard security hole.

Strip, preserve and control

<xsl:strip-space elements="*"/>                 <!-- remove all whitespace-only text nodes -->
<xsl:preserve-space elements="pre code"/>      <!-- never strip inside these -->

<!-- Emit a literal space that would otherwise be stripped from the stylesheet -->
<xsl:text> </xsl:text>

<!-- Control indentation of the result -->
<xsl:output method="xml" indent="yes"/>
<xsl:output method="html" indent="no"/>
  • Without strip-space, whitespace between elements becomes text nodes and can appear as stray spaces in the output.
  • Whitespace inside the stylesheet itself is stripped from template bodies unless it is inside xsl:text.
  • Setting indent="yes" only adds whitespace where it is insignificant for the chosen method — inline content in HTML is never indented.
  • <xsl:strip-space elements="*"> is safe for element-only data and wrong for documents with meaningful spacing in text elements.

Special characters and disable-output-escaping

<!-- In the stylesheet, escape markup with entities -->
&lt;  &gt;  &amp;  &quot;  &apos;

<!-- A CDATA section in a template is still parsed; the real protection is escaping -->
<xsl:template match="code">
  <pre><xsl:value-of select="."/></pre>   <!-- output escaping is applied for you -->
</xsl:template>

<!-- Character maps (XSLT 2.0) fix quoting problems globally -->
<xsl:output use-character-maps="quotes"/>
<xsl:character-map name="quotes">
  <xsl:output-character character="&quot;" string="&amp;quot;"/>
</xsl:character-map>

<!-- The dangerous one -->
<!-- <xsl:value-of select="body" disable-output-escaping="yes"/> -->
⚠️
Never put disable-output-escaping="yes" on anything a user can influence. It turns stored text into live markup and is a direct script-injection path in HTML output. If you need rich text, sanitise it before it reaches the transformer and emit it with an explicit allowlist.

FAQ

Why is my output full of blank lines?
Whitespace-only text nodes in the source are being copied through the default rules. Add xsl:strip-space and set indent on the output element.
How do I emit a non-breaking space?
Use the numeric character reference   directly in the stylesheet, or a character map, rather than relying on a literal space that indentation may change.

Output methods and real use cases Numbering and formatting output

Last refreshed 2026-09-18.