About SQL and XML
 

Is it possible to have every bit of thousands of user information to be stored in XML? If so, what is pros and cons about the security? (Compared to SQL database)

Just think about the way databases are setup. Databases are built in such a way that changes to the structure does not effect any of the program used to access the databases. Where in a XML file, you would have to actually change some of the code thats parsing the XML file to retrieve data. Databases minimizes space as oppose to having a file increasingly grow and as it grows, the time to access information in files is increasing as well. Databases also restrict changes to it unless made by an authorized administrator and who are right to which tables in the databaes. They can also monitor activity to the changes made and if a system fails data is not lost!

XML is not a form of storage, it's a way to mark things up in a hierarchical manner.

XML can be used for many things such as message passing, configuration, and data storing. For a big project you should use an actual database for data storage, but for a small local app XML would be just fine.

Again, XML is a format, not a storage methodology. You could store it in a flat file, or in a database, or on a piece of paper, or whatever.

XML is a format which is nice to to store certain information in because it makes it easy to access different things you need in the file. For example configuration settings. I have worked at a couple places that use XML files for this purpose. As for using them to hold user data and such things a database would for sure be the better choice. But for a small local application, I don't see why using an XML file would be a bad thing.

I'm not saying it's a bad thing. I'm merely trying to correct the perception that it's a storage methodology. The particular container is the methodology. What's in the container might be XML or plain text or any number of things. The container might be a flat file or a relational database or something else. One chooses the format for good reasons and one chooses the container for (other) good reasons.

OK I see what you are saying now ;)