XML is a flexible, tag-based markup language standardized by the W3C for storing and transporting structured, machine-parseable hierarchical data.
XML (Extensible Markup Language) is a standardized text-based markup format established by the World Wide Web Consortium (W3C) in 1998 (XML 1.0). Engineered to be both human-readable and machine-readable, XML uses self-describing hierarchical tags to transport and structure arbitrary data. It remains a foundational backbone for enterprise software, SOAP web services, RSS feeds, SVG vector graphics, and Office Open XML document architectures (.docx, .xlsx).
Format, indent, validate, and beautify XML feeds and documents with our client-side XML Formatter tool.
| Specification | Details |
|---|---|
| Standard Specifications | W3C XML 1.0 (Fifth Edition) / XML 1.1 |
| MIME Media Types | application/xml, text/xml |
| Standard File Extensions | .xml, .xsd, .xsl, .svg, .rss |
| Query & Path Language | XPath / XQuery |
| Schema Validation Models | XSD (XML Schema Definition), DTD (Document Type Definition) |
| Character Encoding | UTF-8 (Default) or UTF-16 |
For an XML document to be processed by compliant parsers, it must be Well-Formed:
<element />).<User> and <user> represent two different elements.id="101").< and & must be escaped using HTML/XML Entities (<, &).<?xml version="1.0" encoding="UTF-8"?>
<catalog status="active">
<tool id="101">
<name>XML Formatter</name>
<category>Web & Code</category>
</tool>
</catalog>
| Architectural Feature | XML | JSON |
|---|---|---|
| Readability | Verbose (repetitive closing tags) | Compact and clean |
| Data Typing | Untyped strings without schema (XSD required) | 6 native primitive types |
| Attributes Support | Native element attributes (<item id="1">) |
Key-value pairs only |
| Parsing Overhead | Heavy (DOM/SAX parsing trees) | Ultra-fast native engine serialization |
| Document Validation | Advanced (XSD, DTD, Schematron) | JSON Schema |
| Primary Domain | Enterprise B2B, SOAP, SVG, RSS, Finance | Modern Web APIs, REST, SPAs, Mobile Apps |
An XML External Entity (XXE) injection vulnerability occurs when weakly configured XML parsers process untrusted input containing a Document Type Definition (DTD) with external entity declarations.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE data [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<data>
<user>&xxe;</user>
</data>
If the parser resolves external entities, it replaces &xxe; with the contents of /etc/passwd, allowing adversaries to read internal server files or mount Server-Side Request Forgery (SSRF) attacks against private cloud metadata services.
Disable external DTD processing entirely in your XML parser configuration:
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)defusedxml instead of standard xml.etree.ElementTree.A CDATA (Character Data) block (<![CDATA[ ... ]]>) tells the XML parser to interpret enclosed text purely as raw character data rather than markup tags. CDATA sections are frequently used to embed code snippets, HTML blocks, or mathematical equations containing < and & without manual entity escaping.
An XML Namespace avoids tag name collisions when combining documents from different schemas. For example, <h:table xmlns:h="http://www.w3.org/TR/html4/"> distinguishes an HTML table element from a furniture <f:table xmlns:f="https://furniture.org">.
Because XML supports element attributes, namespaces, and text nodes within the same element, converting XML to JSON requires mapping rules (such as BadgerFish or Parker conventions). You can format and inspect XML payloads directly with our client-side XML Formatter.
Free, browser-based utilities to test, generate, and inspect XML (Extensible Markup Language) payloads directly.