1) How should I really configure the sources.list? Should I really add those src mirror, security mirror etc?

2)
what are the last 3 sections of the line for? Usually I put

I don't really understand whats the difference between main, non-free, contrib etc.

3) If I were to use 2 mirrors, doing apt-get update then try to apt-get install xchat, if one mirror has a newer version of xchat than the other, will it auto download the newer version?

4) I see some mirrors that has both sarge and testing, which one do I choose?

1) I always just run "apt-setup". You should use the security mirror if you run woody. Other branches I'm not sure if you need it I think you do and I just keep it to be sure. The src mirrors aren't needed if you don't want to download source packages and then build them. I don't have them because I don't use them.
2) One describes the branch (stable, testing, unstable), one is for extra options. That's the one with contrib non-free etc. Contrib was for files that weren't completely opensource or depend on non-open source packages IIRC. Non-free are shareware packages and us/non-us packages is for stuff you some countries can't have due to US law and embargos.
3) I think that depends on which version you're running. I use SID and it'll always do SID first but when I had an experimental file in there I had to explicitly tell it to use the experimental. IIRC you can also change this with a thing called apt pinning which you can do in your apt.conf file.
4) That's the same.

You only need the source line if you want to download source deb packages, and security is only for the stable distribution. I have main, contrib, and non-free just in case I need a package from one of them.

Her is a discription of the archives from the debian policy:


2.2.1 The main section


Every package in main and non-US/main must comply with the DFSG (Debian Free Software Guidelines).


In addition, the packages in main

must not require a package outside of main for compilation or execution (thus, the package must not declare a "Depends", "Recommends", or "Build-Depends" relationship on a non-main package),
must not be so buggy that we refuse to support them, and
must meet all policy requirements presented in this manual.

Similarly, the packages in non-US/main

must not require a package outside of main or non-US/main for compilation or execution,
must not be so buggy that we refuse to support them,
must meet all policy requirements presented in this manual.


2.2.2 The contrib section



Every package in contrib and non-US/contrib must comply with the DFSG.


In addition, the packages in contrib and non-US/contrib

must not be so buggy that we refuse to support them, and
must meet all policy requirements presented in this manual.

Furthermore, packages in contrib must not require a package in a non-US section for compilation or execution.


Examples of packages which would be included in contrib or non-US/contrib are:

free packages which require contrib, non-free packages or packages which are not in our archive at all for compilation or execution, and
wrapper packages or other sorts of free accessories for non-free programs.


2.2.3 The non-free section



Packages must be placed in non-free or non-US/non-free if they are not compliant with the DFSG or are encumbered by patents or other legal issues that make their distribution problematic.


In addition, the packages in non-free and non-US/non-free

must not be so buggy that we refuse to support them, and
must meet all policy requirements presented in this manual that it is possible for them to meet. [3]


2.2.4 The non-US sections



Non-free programs with cryptographic program code need to be stored on the non-us server because of export restrictions of the U.S.


Programs which use patented algorithms that have a restricted license also need to be stored on "non-us", since that is located in a country where it is not allowed to patent algorithms.


A package depends on another package which is distributed via the non-us server has to be stored on the non-us server as well.

hmm...... if I am using testing/sarge, can I include stable/woody mirrors in my sources.list too?