Question

In the thread What’s your favorite “programmer ignorance” pet peeve?, the following answer appears, with a large amount of upvotes:

Programmers who build XML using string concatenation.

My question is, why is building XML via string concatenation (such as a StringBuilder in C#) bad?

I’ve done this several times in the past, as it’s sometimes the quickest way for me to get from point A to point B when to comes to the data structures/objects I’m working with. So far, I have come up with a few reasons why this isn’t the greatest approach, but is there something I’m overlooking? Why should this be avoided?

1. Probably the biggest reason I can think of is you need to escape your strings manually, and most new programmers (and even some experienced programmers) will forget this. It will work great for them when they test it, but then “randomly” their apps will fail when someone throws an & symbol in their input somewhere. Ok, I’ll buy this, but it’s really easy to prevent the problem (SecurityElement.Escape to name one).
2. When I do this, I usually omit the XML declaration (i.e. <?xml version="1.0"?>). Is this harmful?
3. Performance penalties? If you stick with proper string concatenation (i.e. StringBuilder), is this anything to be concerned about? Presumably, a class like XmlWriter will also need to do a bit of string manipulation…
4. There are more elegant ways of generating XML, such as using XmlSerializer to automatically serialize/deserialize your classes. Ok sure, I agree. C# has a ton of useful classes for this, but sometimes I don’t want to make a class for something really quick, like writing out a log file or something. Is this just me being lazy? If I am doing something “real” this is my preferred approach for dealing w/ XML.

Answer 1

You can end up with invalid XML, but you will not find out until you parse it again – and then it is too late. I learned this the hard way.