XML.com FAQs > D. Developers and Implementors (including WebMasters and server operators)
Question:  D.9 Can I (and my authors) still use client-side inclusions?

The same rule applies as for server-side inclusions, so you need to ensure that any embedded code which gets passed to a third-party engine (eg calls to SQL, Java, LiveWire, etc) does not contain any characters which might be misinterpreted as XML markup (ie no angle brackets or ampersands). Either use a CDATA marked section to avoid your XML application parsing the embedded code, or use the standard <, and & character entity references instead.

This FAQ is from The XML FAQ, maintained by Peter Flynn