What Is XML? – Definition and How It Works

Learn what XML is, how elements, attributes, and namespaces work, where it is still standard, and how to parse it safely.

XML is a markup language for structured documents. It predates JSON as the default interchange format and remains standard in publishing, feeds, sitemaps, and many enterprise protocols.

1. The Structure

<?xml version="1.0" encoding="UTF-8"?>
<catalogue xmlns="https://example.com/schema">
  <product id="A-4192" currency="USD">
    <name>Widget</name>
    <price>49.90</price>
    <tags><tag>search</tag><tag>tools</tag></tags>
  </product>
</catalogue>

Elements nest, attributes qualify them, and a declaration states version and encoding.

2. Elements Versus Attributes

There is no rule enforcing the choice, and conventions vary. The common guidance is that attributes carry metadata about an element while elements carry the content itself.

For anyone parsing XML this matters practically: the same information appears as an attribute in one feed and as a child element in another, so extraction code must handle both shapes.

3. Namespaces

Namespaces prevent collisions when documents combine vocabularies. An element belongs to a namespace declared by URI, and queries must account for it.

This is the most common source of confusion when parsing XML: an XPath expression that ignores namespaces matches nothing in a namespaced document, even though the element name looks correct.

4. Where XML Remains Standard

Anyone collecting web data meets it constantly through sitemaps and feeds, whatever the rest of their stack uses.

5. Schemas and Validation

XML has mature schema languages — XSD and older DTDs — that define permitted structure and can validate a document before processing.

That formal validation is more established than in the JSON world, which is part of why XML persists where contracts between organisations must be enforced.

6. Parsing Safely

XML parsers historically supported features that are dangerous with untrusted input: external entity resolution can read local files or make network requests, and entity expansion can consume unbounded memory.

Use a parser configured to disable external entities and limit expansion, or a library that does so by default. This is not a theoretical concern — it is one of the most exploited classes of parsing vulnerability.

7. XML Versus JSON

XML offers namespaces, attributes, comments, formal schema validation, and mixed content. JSON offers less ceremony, direct mapping to native data structures, and smaller payloads.

Neither is superior in general; the choice is usually made by the ecosystem rather than by merit.

8. Summary

XML is a nested markup format with elements, attributes, namespaces, and mature schema validation, still standard for sitemaps, feeds, publishing, and enterprise messaging.

Handle namespaces explicitly when querying, accept that the same data appears as attributes or elements depending on the source, and always disable external entity resolution when parsing anything untrusted.

Potential Related Glossary

• Parsing
• Data Structure
• Unstructured Data
• Web Crawling