title: XmlSerializer escapes an added escape character
body: <p>I'm using the <code>XmlSerializer</code> to output a <code>class</code> to a <code>.xml</code> file.  For the most part, this is working as expected and intended.  However, as a requirement, certain characters need to be removed from the values of the data and replaced with their proper escape characters.</p>
  
  <p>In the elements I need to replace values in, I'm using the <code>Replace()</code> method and returning the updated string.  The code below shows this string replacement; the lines commented out are because the <code>XmlSerializer</code> already escapes those particular characters.</p>
  
  <p>I have a requirement from a third-party to escape <code>&amp;</code>, <code>&lt;</code>, <code>&gt;</code>, <code>'</code>, and <code>"</code> characters when they appear within the values of the XML elements.  Currently the characters <code>&amp;</code>, <code>&lt;</code>, and <code>&gt;</code> are being escaped appropriately through the <code>XmlSerializer</code>.</p>
  
  <p>The error received when these characters are present is:</p>
  
  <blockquote>
    <p>Our system has detected a potential threat in the request message attachment.</p>
  </blockquote>
  
  <p>However, when I serialize the XML Document after performing the string replace, the <code>XmlSerializer</code> sees the <code>&amp;</code> character in <code>&amp;apos;</code> and makes it <code>&amp;amp;apos;</code>.  I think this is a correct functionality of the <code>XmlSerializer</code> object.  However, I would like the serializer to either <strong>a.)</strong> ignore the escape characters; or <strong>b.)</strong> serialize the other characters which are necessary to escape.</p>
  
  <p>Can anyone shed some light on, specifically, how to accomplish either of these?</p>
  
  <p><strong>String Replacement Method</strong>  </p>
  
  <pre><code>public static string CheckValueOfProperty(string str)
  {
      string trimmedString = str.Trim();
  
      if (string.IsNullOrEmpty(trimmedString))
          return null;
      else
      {
          // Commented out because the Serializer already transforms a '&amp;' character into the appropriate escape character.
          //trimmedString = trimmedString .Replace("&amp;", "&amp;amp;");
          //trimmedString = trimmedString.Replace("&lt;", "&amp;lt;");
          //trimmedString = trimmedString.Replace("&gt;", "&amp;gt;");
  
          trimmedString = trimmedString.Replace("'", "&amp;apos;");
          trimmedString = trimmedString.Replace("\"", "&amp;quot;");
  
          return trimmedString;
      }
  }
  </code></pre>
  
  <p><strong>XmlSerializer Code</strong></p>
  
  <pre><code>public static void SerializeAndOutput(object obj, string outputFilePath, XmlSerializerNamespaces ns = null)
  {
      XmlSerializer x = new XmlSerializer(obj.GetType());
  
      // If the Output File already exists, delete it.
      if (File.Exists(outputFilePath))
      {
          File.Delete(outputFilePath);
      }
  
      // Then, Create the Output File and Serialize the parameterized object as Xml to the Output File
      using (TextWriter tw = File.CreateText(outputFilePath))
      {
          if (ns == null)
          {
              x.Serialize(tw, obj);
          }
          else { x.Serialize(tw, obj, ns); }
      }
  
      // =====================================================================
      // The code below here is no longer needed, was used to force "utf-8" to 
      // UTF-8" to ensure the result was what was being expected.
      // =====================================================================
      // Create a new XmlDocument object, and load the contents of the OutputFile into the XmlDocument
      // XmlDocument xdoc = new XmlDocument() { PreserveWhitespace = true };
      // xdoc.Load(outputFilePath);
  
      // Set the Encoding property of each XmlDeclaration in the document to "UTF-8";
      // xdoc.ChildNodes.OfType&lt;XmlDeclaration&gt;().ToList().ForEach(d =&gt; d.Encoding = "UTF-8");
  
      // Save the XmlDocument to the Output File Path.
      // xdoc.Save(outputFilePath);
  }
  </code></pre>