References [66]–[69]
| Form | Example | Meaning |
|---|---|---|
| Character reference [66] | é, é | The character with that code point; the semicolon is required and hex digits may be either case |
| Entity reference [68] | &name; | The replacement text of a general entity, with the semicolon |
| Parameter entity reference [69] | %name; | The replacement text of a parameter entity, within the DTD only |
A character reference must name a legal XML character (WFC: Legal Character):
in XML 1.0 that excludes �, the control codes other than #x9, #xA
and #xD, surrogates, and #xFFFE and #xFFFF. Unlike
HTML, XML has no named references beyond the five
below unless a DTD declares them, and a name that is not declared is a fatal error.
Predefined entities (4.6)
| Entity | Character |
|---|---|
< | < |
> | > |
& | & |
' | ' |
" | " |
A document may declare them for interoperability, but they must then match these
values, with lt and amp double-escaped so that they do not
expand into markup.
Kinds of entity [70]–[76]
| Kind | Declaration | Used as |
|---|---|---|
| Internal general | <!ENTITY name "value"> | &name; in content and attribute values |
| External parsed general | <!ENTITY name SYSTEM "uri"> | &name; in content only (WFC: No External Entity References) |
| Unparsed | <!ENTITY name SYSTEM "uri" NDATA notation> | Only named in ENTITY or ENTITIES attributes; never referenced with &name; (WFC: Parsed Entity) |
| Internal parameter | <!ENTITY % name "value"> | %name; in the DTD |
| External parameter | <!ENTITY % name SYSTEM "uri"> | %name; in the DTD |
An external parsed entity [78] may start with a text declaration [77], which is like an
XML declaration but must have encoding and need not have
version. The first declaration of a name binds: later ones are ignored,
with general and parameter entities in separate namespaces.
How references expand
An entity’s replacement text is its value with character references replaced
at once and parameter references inside the DTD expanded; general references inside it
stay until it is used (4.5). When &name; is used in content, the
replacement text is parsed in place as more content, so an internal entity can hold
elements as long as it is balanced: the start tag and end tag of an element must
both be inside the entity (a parsed entity must be well-formed, 4.3.2).
- An entity may not refer to itself directly or indirectly (WFC: No Recursion).
- A
<may not appear in the replacement text of an entity used in an attribute value (WFC: No < in Attribute Values). - Where an entity is declared in an external subset that a non-validating parser does not read, an undeclared reference is not an error; it is left unresolved.
- A parser must protect itself from documents that expand enormously (the “billion laughs” attack).