XML today: well-formed versus valid, namespaces, and when it is still the right choice

What it is

The XML 1.0 recommendation (cited) separates well-formedness constraints, which every XML document must satisfy (one root element, properly nested and closed elements, quoted attribute values, & and < escaped in content), from validity constraints, which apply only to documents checked against a document type definition or, in practice, a schema language. The Namespaces recommendation (cited) adds expanded names: each element or attribute name is a pair of a namespace name (a URI) and a local name. Prefixes are bound with xmlns:p="uri" and are local conveniences; a default namespace xmlns="uri" applies to unprefixed element names, and the recommendation states that default namespace declarations do not apply directly to attribute names. Declarations are scoped to the element on which they appear and everything below it.

Why it matters

Namespaces are where XML handling most often goes wrong: comparing prefixes instead of URIs, forgetting that a default namespace silently changes the identity of every element beneath it, or serialising with a different prefix and breaking a consumer that string-matches. Knowing where the identity lives (the URI plus local name) removes a whole class of bugs. Knowing the difference between well-formed and valid tells you what a parser without a schema has actually checked: syntax only.

How to apply

• Choose XML for document-like data with mixed content (prose with inline markup), for vocabularies that already are XML (vector graphics, feeds, office and publishing formats), and for exchanges with partners whose validation and signature tooling is XML-based.
• Prefer JSON for records exchanged between programs with no inline markup, where the simpler data model and library support win.
• Compare names as (namespace URI, local name). When querying with XPath or a DOM, bind a prefix to the URI in the query even if the document uses a default namespace, because an unprefixed name in a query does not mean "whatever the default is".
• Validate against a schema at the boundary, and disable external entity resolution in every parser (see the related article).
• Declare the encoding and make the bytes match it; treat whitespace between elements as data unless the schema says it is not.

Pitfalls

The namespace name is compared as a string: http://example.org/ns and http://example.org/ns/ are different namespaces. A prefix with no declaration in scope is an error, not a warning. Re-declaring the default namespace inside a fragment changes the meaning of everything below it. Text nodes hold entity-decoded content; escaping on output is the serialiser's job, and doing it twice produces &.