XML in a Nutshell, 3rd Edition

Entity References

There are three kinds of references in XML instance documents (plus another couple in the DTD we can ignore for the moment):

1. Numeric character references, such as   and  

2. The five predefined entity references, &, >, ", ', and <

3. General entity references defined by the DTD, such as &chapter1; and  

The first two kinds are easy to handle. The parser always resolves them and never tells you anything about them. As a parser client, you can simply ignore these and the right thing will happen. The parser will report the replacement text in the same way it reports regular text. It won’t ever tell you that these entity references were used. On rare occasion you may be able to set a special property on the parser to have it tell you about these things, but you almost never want to do that. The only case where that might make sense is if you’re writing an XML editor that tries to round-trip the source form of a document.

The third case is trickier. These entity references may refer to external files on remote sites you don’t necessarily want to connect to for reasons of performance, availability, or security. Even if they’re internal entities, they may be defined in the external DTD subset in a remote document. Parsers vary in whether they load such entities by default. Most parsers and APIs do provide a means of specifying whether external entities should or should not be loaded, although this is not universal. For instance, XOM always resolves ...