What Is XML?
XML (Extensible Markup Language) stores structured data in a text format that both people and programs can read. Unlike HTML, XML does not provide a fixed set of tags—you name elements to describe your own data.
A First XML Document
<?xml version="1.0" encoding="UTF-8"?>
<email id="msg-1">
<from>alice@example.com</from>
<to>bob@example.com</to>
<subject>Project update</subject>
<body>Status is green & deployment is complete.</body>
</email>The email element is the single root. It contains child elements, text values, and an id attribute.
Core Building Blocks
| Term | Meaning | Example |
|---|---|---|
| Declaration | Optional first line that states the XML version and character encoding. | <?xml version="1.0" encoding="UTF-8"?> |
| Tag | Markup that opens, closes, or represents an empty element. | <date> and </date> |
| Element | A start tag, its content, and a matching end tag. | <date>2026-08-30</date> |
| Attribute | Extra information written inside a start tag. Values must be quoted. | <email priority="high"> |
| Entity reference | A safe way to represent reserved characters in text. | <, >, &, ", ' |
| Comment | A note ignored by normal XML data processing. | <!-- Review before sending --> |
Rules for Well-Formed XML
- Use exactly one root element.
- Close every non-empty element and match tag names exactly; XML is case-sensitive.
- Nest elements correctly—close the most recently opened element first.
- Put quotation marks around every attribute value.
- Escape reserved characters such as
<and&when they are text.
Well-formed XML follows the syntax rules. Valid XML is well-formed and also matches a declared DTD or schema.
Document Type Definitions (DTDs)
A DTD describes which elements and attributes are allowed and how they may be arranged. It can be written inside the XML document or stored in a separate .dtd file.
Internal DTD
<!DOCTYPE email [
<!ELEMENT email (from, to+, subject, body)>
<!ATTLIST email id ID #REQUIRED>
<!ELEMENT from (#PCDATA)>
<!ELEMENT to (#PCDATA)>
<!ELEMENT subject (#PCDATA)>
<!ELEMENT body (#PCDATA)>
]>External DTD
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE email SYSTEM "email.dtd">DTDs are compact and still common in older integrations. XML Schema (XSD) is another option when richer data types and more detailed validation are needed.
XML Entities
XML includes predefined references such as < for < and & for &. A DTD can also declare a reusable internal entity:
<!DOCTYPE company [
<!ENTITY companyName "Plain Library">
]>
<company>&companyName;</company>Security: Do not allow untrusted XML to load external entities or external DTDs. Unsafe parser settings can expose local files, trigger unwanted network requests, or exhaust system resources. Disable DTD processing when it is not required; otherwise disable external entity and external DTD loading.
Where XML Is Still Used
XML remains common in configuration files, document formats, enterprise integrations, web services such as SOAP, and standards that need strict validation or namespaces.