XmlValidate

Last update:

May 18, 2026

Description

Uses a Document Type Definition (DTD) or XML Schema to validate an XML text document or an XML document object.

Returns

The following validation structure:

Field	Description
Errors	An array containing any validator error messages. These messages indicate that the document does not conform to the DTD or Schema (is not valid).
FatalErrors	An array containing any validator fatal error messages. Fatal errors indicate that the document contains XML formatting errors (is not well-formed XML).
Status	A Boolean value: True if the document is valid. False if the validation check failed.
Warning	An array containing any validator warnings. A well-formed and valid document can produce warning messages.

Function syntax

XmlValidate(xml, [validator])

History

ColdFusion (2025.0.08): Added parserOptions struct parameter.

ColdFusion (2018 release): Introduced named parameters.

ColdFusion MX 7: Added this function.

Parameters

Parameter	Description
xml	Any of the following: A string containing an XML document. The name of an XML file. The URL of an XML file; valid protocol identifiers include http, https, ftp, and file. An XML document object, such as one generated by the XmlParse function.
validator	Any of the following: A string containing a DTD or Schema. The name of a DTD or Schema file. The URL of a DTD or Schema file; valid protocol identifiers include http, https, ftp, and file.
allowExternalEntities	(True or False) To enable or disable external entities for the current invocation, specify a valid boolean value. If a valid boolean value is provided, external entities will be enabled or disabled accordingly. If no value is specified or if the value is invalid, the system property value (coldfusion.xml.allowExternalEntities) will be used.
parserOptions	A struct that controls XML parser behavior for the current invocation. Supported keys include: `ALLOWDOCTYPEDECLARATION`: Boolean. Default: `false`. Controls whether XML containing a `<!DOCTYPE ...>` declaration is accepted during validation. `ALLOWEXTERNALENTITIES`: Boolean. Default: `false`. Controls whether external entities can be resolved. `ENTITYEXPANSIONLIMIT`: Numeric. Defines the maximum number of entity substitutions permitted during parsing and validation.

Usage

If you specify a relative URL or filename in a parameter, ColdFusion uses the directory (or, for URLs, the virtual directory) that contains the current ColdFusion page as the path root. The validator parameter specifies a DTD or Schema to use to validate the document. If you omit the parameter, the XML document must contain one of the following:

A !DOCTYPE tag to specify the DTD or its location
An xsi:schemaLocation or xsi:noNamespaceSchemaLocation tag to specify the Schema location If you use a validator parameter and the XML document specifies a DTD or Schema, the XmlValidate function uses the validator parameter, and ignores the specification in the XML document.If you do not use a validator parameter, and the XML document does not specify a DTD or Schema, the function returns a structure with an error message in the Errors field.This function attempts to process the complete XML document, and reports all errors found during the processing. As a result, the returned structure can have a combination of Warning, Error, and FatalError fields, and each field can contain multiple error messages.

DOCTYPE handling during validation

Starting in this release, XmlValidate() blocks XML input that contains a <!DOCTYPE ...> declaration unless you explicitly set parserOptions.ALLOWDOCTYPEDECLARATION = true.This is a breaking change for applications that validate XML documents that embed or depend on a DOCTYPE declaration. If your XML is trusted and intentionally uses a DOCTYPE, enable ALLOWDOCTYPEDECLARATION for that invocation only.If you omit the validator parameter, the XML document can still identify a DTD or schema in the document itself. However, if the XML contains a DOCTYPE declaration, it is rejected unless ALLOWDOCTYPEDECLARATION=true.Enable this option only for trusted XML. Do not enable it for XML received from untrusted users, browsers, or third-party systems that you do not control.

<!--- Trusted XML that legitimately contains a DOCTYPE declaration --->

<cfset opts = {

    ALLOWDOCTYPEDECLARATION = true,

    ALLOWEXTERNALENTITIES = false,

    ENTITYEXPANSIONLIMIT = 1000

}>

<cfset result = XmlValidate(myXmlString, "schema.xsd", opts)>

Note

XML validation sometimes fails due to an imported schema referencing a file using a Linux-style path (for example, home/...) within the <import namespace="..."> tag. This hardcoded path assumes a Linux-based file structure, which may not be supported on Windows, leading to a validation error. As a workaround, update the schema path to match the correct format for the target operating system (for example, use a Windows-style path if running on Windows).

Example

The following example has three parts: an XML file, an XSD Schema file, and a CFML page that parses the XML file and uses the Schema for validation. The CFML file displays the value of the returned structure's Status field and displays the returned structure. To show the results of invalid XML, modify the custorder.xml file.

Note: The Schema used in the following example represents the same XML structure as the DTD used in the XmlParse example.

The custorder.xml file is as follows:

<?xml version="1.0" encoding="UTF-8"?> 

<order xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://localhost:8500/something.xsd" id="4323251" > 

<customer firstname="Philip" lastname="Cramer" accountNum="21"/> 

<items> 

<item id="43"> 

<name> Deluxe Carpenter&apos;s Hammer</name> 

<quantity>1</quantity> 

<unitprice>15.95</unitprice> 

</item> 

<item id="54"> 

<name> 36&quot; Plastic Rake</name> 

<quantity>2</quantity> 

<unitprice>6.95</unitprice> 

</item> 

<item id="68"> 

<name> Standard paint thinner</name> 

<quantity>3</quantity> 

<unitprice>8.95</unitprice> 

</item> 

</items> 

</order>

The custorder.xsd file is as follows:

<?xml version="1.0" encoding="UTF-8"?> 

<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" 

elementFormDefault="qualified"> 

<xs:element name="customer"> 

<xs:complexType> 

<xs:attribute name="firstname" type="xs:string" use="required"/> 

<xs:attribute name="lastname" type="xs:string" use="required"/> 

<xs:attribute name="accountNum" type="xs:string" use="required"/> 

</xs:complexType> 

</xs:element> 

<xs:element name="name" type="xs:string"/> 

<xs:element name="quantity" type="xs:string"/> 

<xs:element name="unitprice" type="xs:string"/> 

<xs:element name="item"> 

<xs:complexType> 

<xs:sequence> 

<xs:element ref="name"/> 

<xs:element ref="quantity"/> 

<xs:element ref="unitprice"/> 

</xs:sequence> 

<xs:attribute name="id" type="xs:integer" use="required"> 

</xs:attribute> 

</xs:complexType> 

</xs:element> 

<xs:element name="items"> 

<xs:complexType> 

<xs:sequence> 

<xs:element ref="item" maxOccurs="unbounded"/> 

</xs:sequence> 

</xs:complexType> 

</xs:element> 

<xs:element name="order"> 

<xs:complexType> 

<xs:sequence> 

<xs:element ref="customer"/> 

<xs:element ref="items"/> 

</xs:sequence> 

<xs:attribute name="id" type="xs:string" use="required"/> 

</xs:complexType> 

</xs:element> 

</xs:schema>

The CFML file is as follows. It uses a filename for the XML file and a URL for the Schema. The XML and URL paths must be absolute.

<cfset 

myResults=XMLValidate("C:\CFusionMX7\wwwroot\examples\custorder.xml", 

"http://localhost:8500/examples/custorder.xsd")> 

<cfoutput> 

Did custorder.xml validate against custorder.xsd? #myResults.status#<br><br> 

</cfoutput> 

Dump of myResults structure returned by XMLValidate<br> 

<cfdump var="#myResults#">

Was this page helpful?

We're glad. Tell us how this page helped.

Found the answer to my problem Understood the instructions Liked the feature

Other suggestions

We're sorry. Can you tell us what didn't work for you?

Didn't find the answer to my problem Couldn't understand the instructions Didn't like the feature

Other suggestions

Thank you for your feedback. Your response will help improve this page.

Was this helpful?

We are sorry the content didn't meet your needs.

Share additional feedback to help us improve.

0/255 | Character limit exceeded.

Thank you so much for sharing your feedback!