Glossary · Programming

XML (Extensible Markup Language)

XML is a text markup format that stores structured data in nested, self-describing tags and is used for feeds, sitemaps, configuration and legacy APIs.

Updated October 6, 2026

XML (Extensible Markup Language) is a text format that represents data as a tree of nested elements written with opening and closing tags, optionally carrying attributes. You define your own tag names, which is why it is called extensible.

Why it matters

XML is still everywhere: sitemaps, RSS and Atom feeds, SVG images, Office documents, Android layouts and many enterprise SOAP services. Compared with JSON it is more verbose, but it supports namespaces, schemas for validation and mixed text-and-markup content.

Example

<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://example.com/</loc>
    <lastmod>2026-10-01</lastmod>
  </url>
</urlset>

Every opening tag needs a matching closing tag, and the document has a single root element.

Common mistakes

  • Forgetting to escape &, < and > in text as &amp;, &lt; and &gt;, which makes the file unparseable.
  • Mixing up XML with HTML; HTML parsers forgive errors, XML parsers do not.
  • Parsing untrusted XML without disabling external entities, which can enable XXE attacks.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · ProgrammingAPI (Application Programming Interface)An API is a defined set of rules and endpoints that lets one piece of software request data or actions from another without knowing its internals.Glossary · ProgrammingGraphQLGraphQL is a query language and runtime for APIs where the client specifies exactly which fields it wants and receives them in a single request.Glossary · ProgrammingJSON (JavaScript Object Notation)JSON is a lightweight text format for structured data built from objects, arrays, strings, numbers, booleans and null, used by most web APIs.Error fix · Browser errorsERR_UNSAFE_PORT: Why Chrome Blocks a Port and What to Use InsteadChrome returns ERR_UNSAFE_PORT for URLs on restricted ports such as 6000 or 6666. See why browsers block them and move your service to a safe port.4 min readError fix · Server errorsHTTP 400 Bad Request: What It Means and How to Fix ItFix HTTP 400 Bad Request as a visitor (cookies, URL, cache) or as a site owner (malformed headers, oversized cookies, proxy and app validation rules).4 min readError fix · Server errorsHTTP 405 Method Not Allowed: Fix GET, POST and OPTIONS ErrorsFix HTTP 405 Method Not Allowed: read the Allow header, correct form and API methods, nginx static POST, Apache limits, CORS preflight and redirect method changes.4 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.