Sign in Get started

Interview Q&A · 28 questions · 13 answered publicly

XML Interview Questions

Ordered by how often they're asked. Sign in free to see every answer, rate your confidence and run timed mock interviews.

  1. Most asked What's the difference between well-formed and valid XML?

    Summary

    Well-formed means the document follows XML syntax: one root, properly nested and closed tags, quoted attributes, escaped special characters. Valid means it's well-formed and also conforms to a schema (DTD, XSD, RELAX NG). A parser must reject malformed XML; validation is an extra, optional step.

    Longer Answer

    Every valid document is well-formed, but not vice versa. In integrations, validate at the boundary so bad messages fail with clear reasons instead of breaking later processing.

    Key Points

    • Well-formed: syntax rules.
    • Valid: also matches a schema.
    • Malformed input is a fatal error.
    • Validate at system boundaries.

    Deep dive: XML Tutorial: Well-Formed XML

    Permalink

  2. Most asked Explain XML namespaces and the default namespace.

    Summary

    A namespace gives element and attribute names a globally unique identity: a URI plus a local name. xmlns:p="uri" binds a prefix; xmlns="uri" sets a default namespace for unprefixed elements in scope. Prefixes are just shorthand: two documents with different prefixes for the same URI mean the same thing. Unprefixed attributes are in no namespace.

    Longer Answer

    The URI is an identifier, not a download location. In code, names are often written in Clark notation, {uri}local.

    Key Points

    • Name = URI + local name.
    • Prefix binding vs default namespace.
    • Prefixes don't matter, URIs do.
    • Unprefixed attributes: no namespace.

    Deep dive: XML Tutorial: XML Namespaces

    Permalink

  3. Most asked Your XPath query returns nothing, but the elements are clearly there. What's the likely cause?

    Summary

    The document has a default namespace, so its elements aren't in 'no namespace'. XPath 1.0 name tests without a prefix only match no-namespace elements. Bind a prefix to the namespace URI and use it in every step (//s:product/s:price). In Java also enable setNamespaceAware(true).

    Longer Answer

    This is the most common XML bug in integrations: a partner adds a namespace, queries silently return empty results, and an import "succeeds" with zero rows. Alert on unexpected zero counts.

    Key Points

    • Default namespace on the document.
    • Prefix + namespace map in the query.
    • Java: namespace-aware factory.
    • Alert on empty results.

    Deep dive: XML in Production: The Import That Found Zero Orders

    Permalink

  4. Most asked Compare DOM, SAX and StAX (or pull parsing).

    Summary

    DOM loads the whole document into a tree: easy random access and XPath, but memory grows with the document (often 5-10x the file). SAX pushes events (start element, text, end element) to callbacks: constant memory, forward-only, more state to manage. StAX/pull parsers let your code ask for the next event: constant memory with simpler control flow.

    Longer Answer

    Use DOM for configs and messages, streaming for large exports and feeds. Python's iterparse and PHP's XMLReader combine streaming with small subtrees.

    Key Points

    • DOM: whole tree.
    • SAX: push events.
    • StAX: pull events.
    • Choose by size and access pattern.

    Deep dive: XML Tutorial: DOM vs Streaming Parsers

    Permalink

  5. Most asked What is an XXE attack and how do you prevent it?

    Summary

    XML External Entity injection: a document declares an entity pointing to a file or URL (<!ENTITY x SYSTEM "file:///etc/passwd">), and a parser that resolves external entities includes the content, disclosing files or making server-side requests (SSRF). Prevent it by disabling DTDs/external entities: Java disallow-doctype-decl, lxml resolve_entities=False, no_network=True, Python defusedxml, PHP no LIBXML_NOENT, .NET DtdProcessing.Prohibit.

    Longer Answer

    Centralise parser creation, don't echo parsed input in errors, and restrict outbound network access from services that parse XML. XXE was in the OWASP Top 10 (2017) and still appears in SOAP, SAML and file uploads (DOCX, SVG).

    Key Points

    • External entity reads files/URLs.
    • File disclosure and SSRF.
    • Disable DTDs per language.
    • Central factory, egress limits.

    Deep dive: XML Tutorial: XML Security: XXE and Entity Attacks

    Permalink

  6. Most asked What is XML and where is it still used today?

    Summary

    XML is a text format for structured data and documents where you define your own tags, nested into a tree, with strict syntax rules and optional schemas. It's still central to Office files (.docx, .xlsx), SVG, EPUB, RSS/Atom, sitemaps, SOAP services, finance (ISO 20022), healthcare (HL7 CDA), e-invoicing (UBL), publishing, and build/configuration files such as Maven and Android.

    Longer Answer

    JSON replaced XML for most web APIs, but XML remains strong where documents with markup, long-lived standards and schema-validated contracts matter. A good answer acknowledges both.

    Key Points

    • Self-describing tree of elements and attributes.
    • Strict well-formedness; optional schemas.
    • Dominant in documents and enterprise standards.
    • JSON won most web APIs.

    Deep dive: XML Tutorial: XML Introduction

    Permalink

  7. Most asked Which characters must be escaped in XML, and what is CDATA?

    Summary

    & and < must always be escaped (&amp;, &lt;) in text and attribute values; quotes must be escaped inside attribute values delimited by the same quote. CDATA sections (<![CDATA[ ... ]]>) let you write text literally; after parsing it's ordinary text, and CDATA can't contain ]]>.

    Longer Answer

    Named entities such as &nbsp; are HTML, not XML. The real lesson: never build XML by string concatenation; use a library that escapes for you.

    Key Points

    • & and < always.
    • Quotes inside attributes.
    • CDATA = literal text, same result after parsing.
    • Use a builder, not string formatting.

    Deep dive: XML Tutorial: Escaping, CDATA and Encoding

    Permalink

  8. Most asked Compare DTD, XML Schema (XSD), RELAX NG and Schematron.

    Summary

    DTD: the original, non-XML syntax, no data types or namespaces, and entity features that cause security issues. XSD: XML syntax, rich data types, namespaces, reuse, the enterprise standard. RELAX NG: simpler, readable grammar (compact syntax), used by DocBook, ODF and EPUB. Schematron: XPath-based rules with human messages for business constraints that grammars can't express.

    Longer Answer

    A strong setup combines a grammar (XSD or RELAX NG) for structure with Schematron for rules like "total equals the sum of lines", as used for EU e-invoicing (EN 16931).

    Key Points

    • DTD: legacy, untyped.
    • XSD: types and namespaces.
    • RELAX NG: simpler grammar.
    • Schematron: business rules.

    Deep dive: XML Tutorial: RELAX NG and Schematron

    Permalink

  9. Most asked Explain XPath axes and give examples of predicates.

    Summary

    An axis sets the direction of a step: child (default), attribute (@), descendant (//), parent (..), ancestor, following-sibling, preceding-sibling, following, preceding, self. Predicates filter: //product[price > 10], //item[@sku='A1'], //product[last()], //p[contains(name, 'tea')].

    Longer Answer

    Watch for //product[1] (first product of each parent) vs (//product)[1] (first in the document), and node-set comparisons that are true if any node matches.

    Key Points

    • Axes set direction.
    • Predicates filter.
    • Positions start at 1.
    • (//x)[1] vs //x[1].

    Deep dive: XML Tutorial: XPath Axes and Functions

    Permalink

  10. Most asked How does XSLT work? Explain templates and apply-templates.

    Summary

    An XSLT stylesheet is a set of template rules. The processor starts at the root, finds the best-matching template, and the template outputs content and calls xsl:apply-templates to process selected nodes with their own matching templates. Built-in rules copy text and recurse when no template matches.

    Longer Answer

    Push style (apply-templates, one template per node type) is more maintainable than one big xsl:for-each. The identity transform plus overrides is the standard way to make small changes to a document.

    Key Points

    • Template rules match patterns.
    • apply-templates recurses.
    • Built-in rules.
    • Identity transform pattern.

    Deep dive: XML Tutorial: XSLT Basics

    Permalink

  11. Most asked How would you process a 10 GB XML file?

    Summary

    Stream it: lxml/ElementTree iterparse with clear() and deletion of processed siblings, PHP XMLReader expanding one record at a time, or Java StAX/SAX. Process in batches with checkpoints so a crash resumes, validate per record, and keep memory flat regardless of size.

    Longer Answer

    Plain iterparse without clearing still builds the full tree. Also consider asking the producer for incremental (delta) feeds.

    Key Points

    • Streaming parser.
    • Clear processed elements.
    • Batches and checkpoints.
    • Per-record validation.

    Deep dive: XML in Production: The 4 GB Product Feed

    Permalink

  12. Most asked What's the difference between SOAP and REST?

    Summary

    SOAP is an XML messaging protocol with an envelope, header and body, formal contracts in WSDL/XSD, faults as XML, and WS-* standards for message-level security and reliability. REST uses HTTP resources and verbs, usually with JSON, HTTP status codes for errors, and TLS/OAuth for security.

    Longer Answer

    SOAP is still common in banking, payments, travel, government and ERP integrations; new public APIs are almost always REST or GraphQL. Generated clients from WSDL make SOAP integration mostly about configuration and error handling.

    Key Points

    • SOAP: envelope, WSDL, faults.
    • REST: resources, HTTP semantics.
    • WS-Security vs TLS/OAuth.
    • Where each is used today.

    Deep dive: XML Tutorial: SOAP and WSDL

    Permalink

  13. Most asked XML, JSON or YAML: how do you choose?

    Summary

    JSON for web and mobile APIs (simple data, native in JavaScript). YAML or TOML for human-edited configuration. XML for documents with markup (mixed content), standards that mandate it (finance, healthcare, publishing, Office/SVG), strict schema-validated contracts, namespaces for combining vocabularies, and XSLT/XQuery pipelines.

    Longer Answer

    Converting XML to JSON needs an explicit mapping: generic converters turn one element into an object and two into an array, and lose types.

    Key Points

    • JSON: APIs.
    • YAML: config.
    • XML: documents, standards, contracts.
    • Explicit mappings when converting.

    Deep dive: XML Tutorial: XML vs JSON vs YAML

    Permalink

  14. Explain the main building blocks of an XML Schema.
  15. How do you design an XML contract that can evolve without breaking consumers?
  16. What is the billion laughs attack?
  17. Why shouldn't you build XML with string concatenation?
  18. How would you design a secure, scalable pipeline for XML from many partners?
  19. When should you use an element and when an attribute?
  20. Why can XPath inside a loop make a job very slow, and how do you fix it?
  21. How do you group data in XSLT 1.0 vs 2.0/3.0?
  22. How do character encodings work in XML, and what causes mojibake?
  23. How do absent, empty and nil elements differ?
  24. What is XML canonicalization and why do signatures need it?
  25. How do you parse XML in Python? Compare ElementTree and lxml.
  26. Which XML APIs does PHP provide?
  27. What is XQuery and how does a FLWOR expression work?
  28. How do you work with XML in the browser and in Node.js?

Was this page helpful?