Well-Formed XML vs Valid XML: What Is the Difference?

The W3C XML specification defines a document as XML only when it is well formed. Among other rules, it needs one document element, matching start and end tags, proper nesting, quoted attribute values, legal names and escaped markup characters where required. XML is case-sensitive, so Item and item are different names. A parser must report a well-formedness error rather than quietly guessing how broken markup should be repaired.

Well-formedness says nothing about whether an application expected a particular element. A document containing <price>blue</price> can be perfectly well formed even if the receiving system requires a decimal number. That second question belongs to a schema, application rules or both.

A DTD can declare allowed elements, attributes and entity definitions. XML Schema Definition, commonly called XSD, can describe structures, namespaces and data types in more detail. Other schema languages also exist. Saying that a document is valid is incomplete unless the grammar or validation rules are identified.

Schema validation can enforce that an invoice has required fields, that children appear in an accepted order, or that a value follows an XSD datatype. It still does not prove every business fact. A schema may accept a correctly shaped account number that does not exist, or a valid date that violates a service's booking policy. Application-level validation remains separate.

XML namespaces use URI references to distinguish names from different vocabularies. In <x:item xmlns:x="urn:stock">, the prefix x is a local shorthand and urn:stock is the namespace name. Another document can use a different prefix for the same namespace. Software should compare expanded names rather than assuming a particular prefix spelling.

A default namespace applies to unprefixed element names in its scope, but it does not automatically apply to unprefixed attributes. Moving or removing a namespace declaration can therefore change the meaning of descendant names even when the visible local names stay the same. A formatter must preserve namespace bindings rather than cosmetically rewriting them without context.

Mixed content places text and child elements together, as in <p>Hello <em>world</em>.</p>. Whitespace between those nodes may be part of the intended prose. A minifier that removes every whitespace-only text node can change a document format that treats spacing as significant. The xml:space attribute can state preservation intent, but an application may define additional whitespace rules.

A CDATA section is a quoting convenience that lets text contain characters such as < and & without treating them as markup, except for the ]]> terminator. It does not create a different data type or make embedded text executable. After parsing, applications commonly receive CDATA content as character data. Comments and processing instructions are separate node types and may also matter to a workflow.

DTDs can define entities, and some XML parsers can resolve external entities from files or network locations. If untrusted input controls those references, unsafe parser configuration can expose local files, make server-side requests, consume resources or leak data. OWASP recommends disabling DTDs or external entity resolution when the application does not need them and applying parser-specific hardening when it does.

A browser-local formatter does not need to retrieve external DTDs to indent a document. UtilSprout XML Formatter rejects DOCTYPE and entity declarations before formatting or minifying. That conservative choice prevents external resource resolution in this tool, but it also means documents that legitimately depend on a DTD are outside its supported input.

The formatter checks that the submitted input can be parsed as well-formed XML under its local security restrictions. It can format, minify and report parser errors while preserving comments, namespace declarations and CDATA where the browser parser and serializer support them. It does not fetch schemas, DTDs, images, stylesheets or other remote resources.

The tool does not validate against XSD, Relax NG, Schematron or an application contract. A message that formats successfully can still be invalid for an API. Conversely, a document rejected because it contains a DOCTYPE may be well formed according to XML 1.0 but intentionally unsupported by this security-focused formatter. Use the system's trusted schema validator when conformance to a specific grammar is required.