> That issue is considered a feature by many. Don't send out broken web pages. If you don't build your pages using string concatenation you have already elimin

> That issue is considered a feature by many. Don't send out broken web pages. If you don't build your pages using string concatenation you have already eliminated most problems (it's just like SQL, in that respect). Yes, but there weren't many tools to "correctly" compose XHTML back then. > XML parsers are not that bad when you disable custom entities, which browsers could easily do. Yes, but it's another thing browser developers need to think of. A lot of CVEs already originate in browser. Even if it's actually safe, people who got burnt by XML, would have bad opinions about XML in mind.