XML Parser

Well-formed XML follows the basic syntax rules of XML (proper nesting, closing tags, single root element). Valid XML is well-formed AND conforms to a schema (DTD, XSD) that defines the allowed structure and data types.

No, this tool checks for well-formedness only (syntax correctness). Schema-based validation against DTD or XSD is not supported in the browser natively.

The browser's native document.evaluate() supports XPath 1.0. This covers most common queries including axes, predicates, and functions like contains(), text(), and @attribute.

A namespace maps element names to a URI via xmlns attributes - for example an atom:feed element declaring xmlns:atom="http://www.w3.org/2005/Atom". The prefix is arbitrary; only the URI identifies the namespace, so two documents can use different prefixes for the same vocabulary. Namespaces are why XPath matching often needs local-name() tricks when prefixes differ.

XPath 1.0 expressions walk the tree: /rss/channel/item selects by path, //item finds items anywhere in the document, item[@type='news'] filters on an attribute, and predicates like item[1] or item[last()] pick specific nodes. It is the query language behind XSLT, many test frameworks, and this tool's evaluator.

XXE (XML External Entity) injection abuses a DTD entity pointing at a file path or URL, making a server-side parser fetch it - historically leaking /etc/passwd or internal services. Browser XML parsers do not resolve external entities, and this tool runs entirely in your browser with no server round-trip, so pasted XML cannot trigger file reads or SSRF.

DOM loads the whole document into a tree you can navigate randomly - intuitive but memory-hungry for huge files. SAX streams events (start tag, text, end tag) in a single pass with constant memory - fast but forward-only. Browser JavaScript exposes DOMParser (DOM-style); streaming XML in JavaScript needs a library or Web Streams.

Escape them as &lt; and &amp; in ordinary text - < and & are illegal raw in character data. For blocks of markup-heavy text, wrap it in a CDATA section, which needs no escaping until it hits the sequence ]]> at its end. Only < and & are strictly required in content; > must be escaped only when it forms that closing sequence.