Why one character breaks a whole file
XML uses the ampersand to begin an entity reference. When a parser meets one, it expects a name and a semicolon to follow. A bare ampersand in the middle of a URL is therefore a syntax error, not a stylistic issue.
And XML parsing is not forgiving. Unlike HTML, where browsers recover from almost anything, an XML parser hitting a syntax error is entitled to stop. So a single bad character in entry four thousand can invalidate everything.
This is why it appears as an error rather than a warning, and why it is worth fixing even if the file currently seems to work in some tools.
The five characters that need escaping
Ampersand is the one that bites in practice, because URLs with multiple query parameters are full of them. The others matter less often but the rules are the same.
| Character | Write as | Where it appears |
|---|---|---|
| & (ampersand) | & | Query strings with several parameters |
| < (less than) | < | Rare in URLs, common in mangled data |
| > (greater than) | > | Rare in URLs |
| " (double quote) | " | Inside attribute values |
| ' (apostrophe) | ' | Inside attribute values |
Why your generator is doing this
Hand-written sitemaps and naive generators are the usual sources, and the pattern is the same in both: a URL string is concatenated into the XML without being escaped first.
If you are generating XML with string templates, that is the bug. Escaping has to happen at the point the URL goes into the document, not earlier or later.
A useful signal: if the URLs with problems all have query strings and the clean ones do not, you have confirmed the cause. Parameter-free URLs contain no ampersands to break.
The other question worth asking is whether those parameter URLs belong in the sitemap at all. Tracking parameters and session identifiers should generally be excluded rather than escaped.
Common questions
How do I escape an ampersand in a sitemap?+
Write it as &. So a URL with two query parameters becomes ...?a=1&b=2 inside the sitemap XML.
Why does one bad character break the whole sitemap?+
Because XML parsing is strict. Unlike HTML, where browsers recover from almost anything, an XML parser meeting a syntax error is entitled to stop, so one unescaped ampersand can invalidate everything after it.
Which other characters need escaping?+
Less than, greater than, double quote and apostrophe, written as <, >, " and '. Ampersand is the one that actually causes problems, because query strings are full of them.
Should parameter URLs even be in my sitemap?+
Often not. Tracking parameters and session identifiers create duplicate URLs for one page and are usually better excluded than escaped.
Sources