XML Markup Language Cheat Sheet_v1_references

References

Official Documentation

1. W3C XML 1.0 Specification (Fifth Edition) - https://www.w3.org/TR/xml/
2. W3C XML Namespaces Specification - https://www.w3.org/TR/xml-names/
3. W3C XML Schema Part 0: Primer - https://www.w3.org/TR/xmlschema-0/
4. W3C XML Schema Part 1: Structures - https://www.w3.org/TR/xmlschema-1/
5. W3C XML Schema Part 2: Datatypes - https://www.w3.org/TR/xmlschema-2/
6. W3C XPath 3.0 Specification - https://www.w3.org/TR/xpath-30/
7. W3C XPath and XQuery Functions 3.1 - https://www.w3.org/TR/xpath-functions-31/
8. W3C XSLT 3.0 Specification - https://www.w3.org/TR/xslt-30/
9. W3C XML Signature Syntax and Processing - https://www.w3.org/TR/xmldsig-core/
10. W3C Canonical XML Version 1.0 - https://www.w3.org/TR/2000/WD-xml-c14n-20000601
11. W3C XML Encryption Syntax and Processing - https://www.w3.org/TR/xmlenc-core/
12. W3C XLink 1.1 - https://www.w3.org/TR/xlink11/
13. W3C XPointer Framework - https://www.w3.org/TR/xptr-framework/
14. W3C XInclude - https://www.w3.org/TR/xinclude/
15. W3C SVG (Scalable Vector Graphics) 2 - https://www.w3.org/TR/SVG2/
16. W3C XHTML 1.0 Specification - https://www.w3.org/TR/xhtml1/
17. W3C SOAP Version 1.2 - https://www.w3.org/TR/soap/
18. OASIS XML Catalogs Specification - https://www.oasis-open.org/committees/download.php/14809/xml-catalogs.html
19. RSS 2.0 Specification - https://www.rssboard.org/rss-specification
20. ECMA-376: Office Open XML File Formats - https://www.ecma-international.org/publications-and-standards/standards/ecma-376/

Technical Blogs & Tutorials

21. W3Schools XML Tutorial - https://www.w3schools.com/xml/
22. W3Schools XPath Tutorial - https://www.w3schools.com/xml/xpath_intro.asp
23. W3Schools XSLT Tutorial - https://www.w3schools.com/xml/xsl_intro.asp
24. W3Schools XML Schema Tutorial - https://www.w3schools.com/xml/schema_intro.asp
25. W3Schools XML Namespaces - https://www.w3schools.com/xml/xml_namespaces.asp
26. Oracle XML Schema Tutorial: Understanding Namespaces - https://www.oracle.com/technical-resources/articles/srivastava-namespaces.html
27. Oracle XML Schema: Understanding Datatypes - https://www.oracle.com/technical-resources/articles/srivastava-datatypes.html
28. Oracle XML Schema: Understanding Structures - https://www.oracle.com/technical-resources/articles/srivastava-structures.html
29. Oracle: What You Need to Know About Whitespace in XML - https://www.oracle.com/technical-resources/articles/wang-whitespace.html
30. TutorialsPoint XML Tutorial - https://www.tutorialspoint.com/xml/
31. TutorialsPoint DTD Tutorial - https://www.tutorialspoint.com/dtd/
32. TutorialsPoint XSLT Tutorial - https://www.tutorialspoint.com/xslt/
33. Liquid Technologies XML Schema Tutorial - https://www.liquid-technologies.com/xml-schema-tutorial/
34. XML Training Guide: How XML Parsing Works (DOM vs SAX vs StAX) - https://xml-training-guide.com/how-xml-parsing-works-dom-vs-sax-vs-stax/
35. XML Training Guide: Character Encoding in XML - https://xml-training-guide.com/character-encoding-in-xml-utf-8-utf-16-and-beyond/
36. Digital Humanities: XSLT Keys - https://dh.obdurodon.org/keys.xhtml
37. Digital Humanities: Modal XSLT - https://dh.obdurodon.org/modal-xslt.html
38. Digital Humanities: Relax NG Content Models - https://dh.obdurodon.org/relaxng_mixed-content.xhtml
39. MDN Web Docs: Introduction to Using XPath in JavaScript - https://developer.mozilla.org/en-US/docs/Web/XML/XPath/Guides/Introduction_to_using_XPath_in_JavaScript
40. MDN Web Docs: XSLT Element Reference - https://developer.mozilla.org/en-US/docs/Web/XML/XSLT/Reference/Element
41. MDN Web Docs: XPath Functions Reference - https://developer.mozilla.org/en-US/docs/Web/XML/XPath/Reference/Functions
42. Real Python: A Roadmap to XML Parsers in Python - https://realpython.com/python-xml-parser/
43. Scrapfly Blog: How to Use Python lxml for HTML and XML Parsing - https://scrapfly.io/blog/posts/intro-to-parsing-html-xml-python-lxml
44. DEV Community: How to Parse XML Fast in 2026 (Python) - https://dev.to/mohammadraziei/how-to-parse-xml-fast-in-2026-python-20fd
45. Medium: Understanding Serialization and Deserialization - https://medium.com/tuanhdotnet/understanding-serialization-and-deserialization-methods-examples-and-best-practices-ff425425d693
46. Medium: c14n — Canonical XML and Exclusive XML Canonicalization - https://medium.com/@instatunnel/logically-the-same-but-different-canonical-xml-and-exclusive-xml-canonicalization-663b8e81dfda
47. Medium: Billion Laughs Attack: The XML That Brings Servers to Their Knees - https://medium.com/@instatunnel/billion-laughs-attack-the-xml-that-brings-servers-to-their-knees-f83ba617caa4
48. Medium: The Power of XPath Union in Selenium - https://medium.com/@mr.nirajkrsingh19/the-power-of-xpath-union-in-selenium-a75352295ee8
49. Medium: XML-XSL Transformation: Unlocking the Power of Data Presentation - https://medium.com/@khushi.jitani/xml-xsl-transformation-unlocking-the-power-of-data-presentation-and-interoperability-72fdc79d2a4b
50. XML.com: Declaring Keys and Performing Lookups - https://www.xml.com/pub/a/2002/02/06/key-lookups.html

GitHub Repositories & Code Examples

51. lxml - Processing XML and HTML with Python - https://lxml.de/
52. pugixml: XPath union results in node order - https://github.com/zeux/pugixml/issues/254
53. russellhaering/goxmldsig: Pure Go XML Digital Signature - https://github.com/russellhaering/goxmldsig
54. Microsoft OpenSpecs: XML Section 4.1, Character and Entity References - https://learn.microsoft.com/en-us/openspecs/ie_standards/ms-xmlh/70973de4-356d-4b5e-93a1-4138d5bfd17a
55. Altova XMLSpy 2026 Documentation - https://www.altova.com/manual/XMLSpy/spyenterprise/
56. Saxon XSLT and XQuery Processor Documentation - https://www.saxonica.com/html/documentation12/
57. InterSystems IRIS %XML.Namespaces Documentation - https://docs.intersystems.com/irislatest/csp/documatic/%25CSP.Documatic.cls?LIBRARY=%25SYS&CLASSNAME=%25XML.Namespaces

Security Resources

58. OWASP: XML External Entity (XXE) Processing - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
59. OWASP Cheat Sheet: XML External Entity Prevention - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
60. OWASP Cheat Sheet: Deserialization - https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html
61. OWASP: XPath Injection - https://owasp.org/www-community/attacks/XPATH_Injection
62. PortSwigger: XML External Entity (XXE) Injection - https://portswigger.net/web-security/xxe
63. PortSwigger: Guide to XML Entities - https://portswigger.net/web-security/xxe/xml-entities
64. PortSwigger: XML Entity Expansion - https://portswigger.net/kb/issues/00400700_xml-entity-expansion
65. Snyk: Preventing XXE Attacks - Strategies for Secure XML Processing - https://snyk.io/articles/preventing-xxe-attacks-strategies-for-secure-xml-processing/
66. Bright Security: XML Injection: Risks, Prevention, Best Practices - https://brightsec.com/blog/understanding-xml-injection-risks-prevention-and-best-practices/
67. Wikipedia: Billion Laughs Attack - https://en.wikipedia.org/wiki/Billion_laughs_attack
68. ZAP: Exponential Entity Expansion (Billion Laughs Attack) - https://www.zaproxy.org/docs/alerts/40044/
69. GitHub Advisory: DoS through entity expansion in DOCTYPE - https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673
70. Salesforce Trailhead: Preventing XML External Entity Attacks - https://trailhead.salesforce.com/content/learn/modules/security-principles/prevent-extensible-markup-language-external-entity-attacks
71. Microsoft Learn: XML Denial of Service Attacks and Defenses - https://learn.microsoft.com/en-us/archive/msdn-magazine/2009/november/xml-denial-of-service-attacks-and-defenses
72. Semgrep: Prevent XML External Entity Vulnerabilities for Java - https://semgrep.dev/docs/cheat-sheets/java-xxe
73. SentinelOne CVE Database: CVE-2026-25896, CVE-2026-25128, CVE-2026-26278 - https://www.sentinelone.com/vulnerability-database/
74. Chrome for Developers: Removing XSLT for a more secure browser - https://developer.chrome.com/docs/web-platform/deprecating-xslt

Academic Papers & Standards Bodies

75. ResearchGate: A Comparative Performance Evaluation of DOM, SAX, and StAX - https://www.researchgate.net/publication/402717814_A_Comparative_Performance_Evaluation_of_DOM_SAX_and_StAX_Parsing_Algorithms
76. IETF: Exclusive XML Canonicalization - https://datatracker.ietf.org/doc/draft-ietf-xmldsig-xc14n/
77. IETF Datatracker: XML Digital Signatures Working Group - https://datatracker.ietf.org/wg/xmldsig/about/
78. W3C Entity Definitions for Characters (3rd Edition) - https://w3c.github.io/xml-entities/
79. OASIS: XML Character Entities - https://www.oasis-open.org/docbook/specs/wd-docbook-xmlcharent-0.3.pdf
80. Wikipedia: List of XML and HTML Character Entity References - https://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_references
81. Wikipedia: XML Signature - https://en.wikipedia.org/wiki/XML_Signature
82. Wikipedia: Canonical XML - https://en.wikipedia.org/wiki/Canonical_XML
83. Wikipedia: UTF-8 - https://en.wikipedia.org/wiki/UTF-8

Microsoft Learn & .NET Resources

84. Microsoft Learn: XML Document Object Model (DOM) - https://learn.microsoft.com/en-us/dotnet/standard/data/xml/xml-document-object-model-dom
85. Microsoft Learn: Details of XML Serialization - https://learn.microsoft.com/en-us/dotnet/standard/serialization/introducing-xml-serialization
86. Microsoft Learn: White Space and Significant White Space Handling - https://learn.microsoft.com/en-us/dotnet/standard/data/xml/white-space-and-significant-white-space-handling-when-loading-the-dom
87. Microsoft Learn: Managing Namespaces in an XML Document - https://learn.microsoft.com/en-us/dotnet/standard/data/xml/managing-namespaces-in-an-xml-document
88. Microsoft Learn: Including or Importing XML Schemas - https://learn.microsoft.com/en-us/dotnet/standard/data/xml/including-or-importing-xml-schemas
89. Microsoft Learn: XSLT Parameters - https://learn.microsoft.com/en-us/dotnet/standard/data/xml/xslt-parameters
90. Microsoft Learn: How to Verify Digital Signatures of XML Documents - https://learn.microsoft.com/en-us/dotnet/standard/security/how-to-verify-the-digital-signatures-of-xml-documents
91. Microsoft Learn: XmlDsigC14NTransform Class - https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.xml.xmldsigc14ntransform
92. Microsoft Learn: XmlDeclaration.Encoding Property - https://learn.microsoft.com/en-us/dotnet/api/system.xml.xmldeclaration.encoding
93. Microsoft Learn: xml:space Handling in XAML - https://learn.microsoft.com/en-us/dotnet/desktop/xaml-services/xml-space-handling
94. Microsoft Learn: xsd:sequence Element - https://learn.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/ms256089(v=vs.100)
95. Microsoft Learn: xsd:choice Element - https://learn.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/ms256109(v=vs.100)
96. Microsoft Learn: xsd:simpleType Element - https://learn.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/ms256050(v=vs.100)
97. Microsoft Learn: Validate XML Document by DTD, XDR, or XSD - https://learn.microsoft.com/en-us/troubleshoot/developer/visualstudio/visual-basic/language-compilers/validate-xml-document-by-dtd-xdr-xsd
98. Microsoft Business Central: XML Comments in Code - https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/developer/devenv-xml-comments

Oracle & Java Resources

99. Oracle Java Documentation: Java XML Digital Signature API - https://docs.oracle.com/javase/8/docs/technotes/guides/security/xmldsig/XMLDigitalSignature.html
100. Oracle Help Center: EntityReference (Java SE 26 & JDK 26) - https://docs.oracle.com/en/java/javase/26/docs/api/java.xml/org/w3c/dom/EntityReference.html
101. Oracle Help Center: CDATASection (Java SE 26 & JDK 26) - https://docs.oracle.com/en/java/javase/26/docs/api/java.xml/org/w3c/dom/CDATASection.html
102. Oracle Documentation: ID/IDREF Support - https://docs.oracle.com/en/applications/jd-edwards/interoperability/9.2.x/eotin/id-idref-support.html
103. Oracle Database: Using XPath Functions - https://docs.oracle.com/cd/E68885_01/doc.731/e68892/dev_xpath_functions.htm
104. Java Tutorial: Streaming API for XML (StAX) - https://docs.oracle.com/javase/tutorial/jaxp/stax/why.html
105. Java EE Tutorial: JAXB (Java Architecture for XML Binding) - https://docs.oracle.com/javaee/5/tutorial/doc/bnazf.html

IBM Resources

106. IBM: XML Entity References - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/dd892769(v=vs.85)
107. IBM: XML Whitespace - https://www.liquid-technologies.com/Reference/Glossary/XML_Whitespace.html
108. IBM: XML Parsing and Whitespace Handling - https://www.ibm.com/docs/en/db2-for-zos/12.0.0?topic=parsing-xml-whitespace-handling
109. IBM: Securing System Settings (XML Canonicalization) - https://www.ibm.com/docs/en/b2b-integrator/6.2.1?topic=overview-securing-system-settings
110. IBM: XML Standalone - https://www.ibm.com/docs/en/app-connect/13.0.x?topic=declaration-xml-standalone
111. IBM: XML ProcessingInstruction - https://www.ibm.com/docs/en/app-connect/11.0.0?topic=body-xml-processinginstruction
112. IBM: XML Digital Signature Security Overview - https://www.ibm.com/docs/en/b2badv-communication/1.0.1?topic=overview-xml-digital-signature-security
113. IBM: XMLNS Empty Elements and Null Values - https://www.ibm.com/docs/en/app-connect/11.0.0?topic=parser-xmlns-empty-elements-null-values
114. IBM: xs:minLength - https://www.ibm.com/docs/en/tamino/10.7.0?topic=guide-xsminlength
115. IBM: xs:restriction - https://www.ibm.com/docs/en/tamino/10.7.0?topic=guide-xsrestriction
116. IBM: XPath Expression Wizard - https://www.ibm.com/docs/en/data-studio/4.1.1?topic=expressions-xpath-expression-wizard-syntax-reference-options
117. IBM: Redefining XSD Schema Components - https://www.ibm.com/docs/en/rsas/7.5.0?topic=files-redefining-xsd-schema-components
118. IBM: Setting Parameters with XSLT - https://www.ibm.com/docs/en/was/8.5.5?topic=variables-setting-parameters-xslt
119. IBM: Working with CDATA Section - https://www.ibm.com/docs/en/cics-tx/10.1.0?topic=reference-working-cdata-section

Python Resources

120. Python Documentation: xml.etree.ElementTree - https://docs.python.org/3/library/xml.etree.elementtree.html
121. Python Documentation: XML Processing Modules - https://docs.python.org/3/library/xml.html
122. Python lxml APIs - https://lxml.de/api.html
123. Making of Close: State of XML Parsing in Python - https://making.close.com/posts/state-of-xml-parsing-in-python/

Stack Overflow & Community Forums

124. Stack Overflow: What are the differences between DOM, SAX and StAX XML parsers? - https://stackoverflow.com/questions/21019509/what-are-the-differences-between-dom-sax-and-stax-xml-parsers
125. Stack Overflow: What are the differences between lxml and ElementTree? - https://stackoverflow.com/questions/47229309/what-are-the-differences-between-lxml-and-elementtree
126. Stack Overflow: Best practices - XML attribute vs XML element - https://stackoverflow.com/questions/395527/best-practices-xml-attribute-vs-xml-element-when-should-i-use-elements-and-wh
127. Stack Overflow: Is there any difference between 'valid xml' and 'well formed xml'? - https://stackoverflow.com/questions/134494/is-there-any-difference-between-valid-xml-and-well-formed-xml
128. Stack Overflow: What does <![CDATA[]]> in XML mean? - https://stackoverflow.com/questions/2784183/what-does-cdata-in-xml-mean
129. Stack Overflow: XML namespaces default vs namespace prefix - https://stackoverflow.com/questions/78141849/xml-namespaces-default-vs-namespace-prefix
130. Stack Overflow: Can an XML element have both text and element content? - https://stackoverflow.com/questions/66148477/can-an-xml-element-have-both-text-and-element-content
131. Stack Overflow: What's the difference between xsd:include and xsd:import? - https://stackoverflow.com/questions/2357943/whats-the-difference-between-xsdinclude-and-xsdimport
132. Stack Overflow: XPath combine node sets - https://stackoverflow.com/questions/20725383/xpath-combine-node-sets
133. Stack Overflow: How does the billion laughs XML DoS attack work? - https://stackoverflow.com/questions/3451203/how-does-the-billion-laughs-xml-dos-attack-work
134. Stack Overflow: Survey: how are you using ID/IDREF? - https://stackoverflow.com/questions/1102142/survey-how-are-you-using-id-idref-or-key-keyref
135. Stack Overflow: XSD maxLength and minLength applied to integer - https://stackoverflow.com/questions/41794427/xsd-maxlength-and-minlength-applied-to-integer
136. Stack Overflow: Combine XPATH predicate with position - https://stackoverflow.com/questions/4961349/combine-xpath-predicate-with-position
137. Stack Overflow: How to verify xmldsig signature using java.security - https://stackoverflow.com/questions/50744409/how-to-verify-xmldsig-signature-using-java-security
138. Stack Overflow: How to Verify XML Digital Signature in python - https://stackoverflow.com/questions/70687928/how-to-verify-xml-digital-signature-in-python-xmldsig

Testing & Automation Resources

139. TestMu AI: XPath in Selenium: Complete Guide With Examples 2026 - https://www.testmuai.com/blog/complete-guide-for-using-xpath-in-selenium-with-examples/
140. Testomat.io: XPath in Selenium Cheat Sheet: Syntax & Examples [2026] - https://testomat.io/blog/xpath-in-selenium/
141. BugBug.io: The Ultimate XPath Cheat Sheet - https://bugbug.io/blog/testing-frameworks/the-ultimate-xpath-cheat-sheet/
142. SerpApi: XPath Selector Cheat Sheet: Practical Examples Included - https://serpapi.com/blog/xpath-selector-cheat-sheet-practical-examples-included/
143. Hackr.io: How To Use XPath In Selenium [2026] - https://hackr.io/blog/xpath-in-selenium
144. Sauce Labs: How To Use XPath In Selenium Tutorial - https://saucelabs.com/resources/blog/xpath-in-selenium-getting-started

Additional Resources

145. Oxygen XML: XML Validation and Well-Formedness Check - https://www.oxygenxml.com/xml_author/validation.html
146. Oxygen XML: xs:sequence / xs:choice / xs:all - https://www.oxygenxml.com/doc/ug-oxygen/topics/xml-schema-diagram-compositors-properties.html
147. Liquid Technologies: XML Glossary - https://www.liquid-technologies.com/Reference/Glossary/
148. Quackit.com: XML CDATA - https://www.quackit.com/xml/tutorial/xml_cdata.cfm
149. Quackit.com: DTD Elements - https://www.quackit.com/xml/tutorial/dtd_elements.cfm
150. InformIT: Restricting Simple Types by Using XML Schema Facets - https://www.informit.com/articles/article.aspx?p=417508&seqNum=76
151. O'Reilly: XML Schema - xs:minLength - https://www.oreilly.com/library/view/xml-schema/0596002521/re38.html
152. O'Reilly: Processing Instructions - XML Pocket Reference - https://www.oreilly.com/library/view/xml-pocket-reference/9780596100506/ch01s02s07.html
153. O'Reilly: XPath Node Tests - XSLT - https://www.oreilly.com/library/view/xslt/0596000537/apbs02.html
154. StationX: The XPath Cheat Sheet Every Developer Needs - https://www.stationx.net/xpath-cheat-sheet/
155. IONOS: XPath Tutorial for Beginners - https://www.ionos.com/digitalguide/websites/web-development/xpath-tutorial/