Hi All,

It is said that XML is most unsecured way of transacting online. I just want to know why still it is used most widely.

Thanks in advance for any help.

Plain text is plain text, whatever file format the data is actually in. Obscure formats may slow down an attacker looking for an easy target, but they will take more effort to create and use. XML is able to be understood by many languages and systems and so is easy to use. Security and encryption should have nothing to do with the data format being transmitted, other than using the most suitable encyption scheme for the transmission medium, i.e. streaming or file transfer.

That's easily explained...

XML is simply a file-format. If you look at the source-code to an HTML page, an XML file looks a whole lot like that, with "tags" that are interspersed with text.

What makes the XML format interesting and useful is that it consists of "ordinary text" and it is self-describing. The tags are arranged in a hierarchical structure such that programs can readily extract any piece or section of information from it. They can also verify the XML file against a so-called document-type definition (DTD) to verify that the document they received conforms to the tag-arrangement they expect.

For example, an "invoice" contains a "invoice-identifier," a "bill-to customer information" section, an optional "ship-to customer section," and a collection of zero or more "line items." You can express such a data-structure easily in XML. The application receiving it can first verify the received data against the DTD, then proceed to parse the data. The "invoice" describes itself sufficiently to allow this.

But XML contains no security provisions whatever. It's not designed to. Any practical application of XML on a public network for a financial or business transaction would necessarily employ some kind of encryption or security technology -- such as, say, SSL2 ("https:") to make sure that all of the information being exchanged (XML or not...) will be transferred securely and without compromise.

Yes you can use xml security library to encrypt the xml data you need to protect.