XML Tools Reference

Your brief

Use the syntax playground for small declaration-free XML, browser DOM APIs for node edits, XPath 1.0 for paths in the browser or lxml, XSD 1.0 for the lab’s schema validation and Saxon for XQuery 3.1 or XSLT 3.0. DOM Node, Document, Element, Attr, Text, CDATASection, Comment, NodeList and NamedNodeMap are related interfaces with different contracts. The earlier browser lessons test those differences rather than copying a giant alphabetical API list.

Run the code

Use Python 3 with lxml 6.1.1 in a separate virtual environment. The complete listing embeds its own XML and any schema or stylesheet; run python reference-guide.py. It does not need Apache or MySQL. The shared restrictive parse function rejects declarations for untrusted input. The trusted DTD/entity and streaming lessons explicitly explain their separate fixed-input boundaries.

Download the complete reference-guide.py source. Keep each lab in its own folder. Sources are served as text, not as public executable server scripts. Review the starting setup.

Worked solution

from lxml import etree as E

class DenyExternal(E.Resolver):
    def resolve(self, url, public_id, context):
        raise ValueError("External resources are disabled")

def parse(text):
    if "<!DOCTYPE" in text.upper() or "<!ENTITY" in text.upper():
        raise ValueError("Declarations are disabled for untrusted XML")
    parser = E.XMLParser(resolve_entities=False, load_dtd=False,
                         no_network=True, huge_tree=False)
    parser.resolvers.add(DenyExternal())
    return E.fromstring(text.encode("utf-8"), parser)

source = "<exchange region=\"west\">\n  <packet id=\"p1\" available=\"true\"><name>Marigold</name><quantity>12</quantity><category>flower</category></packet>\n  <packet id=\"p2\" available=\"false\"><name>Fenugreek</name><quantity>0</quantity><category>herb</category></packet>\n  <packet id=\"p3\" available=\"true\"><name>Basil</name><quantity>7</quantity><category>herb</category></packet>\n</exchange>"
root = parse(source)
print("records:", int(root.xpath("count(packet)")))
print("available:", root.xpath("packet[@available='true']/@id"))

records: 3
available: ['p1', 'p3']

Extend and test

Choose a tool for each job: reject a duplicate document key, create a browser text node, group records into categories and send a checked HTTP request. State one limitation for each choice.