Alex Krawarik [MSFT] wrote:
> I am sorry, VK, but this is *absolutely* the wrong approach. Do not assume
> that a "higher" version of MSXML is somehow better, because that is not true
> in most cases. In fact MSXML3 or MSXML6 is what you will want to use for
> most applications, regardless of what you are working on.

The first thing you want to ensure is that you are using the most
_secure_ version of MSXML out of available on the current machine. In
this respect MSXML3 is the last resort you should use only after having
tried all higher versions.
For really primitive cases (some plain-vanilla ajaxoid) you may try -
after anything else - Microsoft.XMLHTTP. Most of the time though MSXML3
is your last and worst fall-back point.

If you have any doubts about it, check it with the general Microsoft
opinion: install a fresh copy of IE6 build 2001-2003 and run Windows
Update service. What is among the crucial updates? Right, MSXML4
instead of MSXML3. Why? You don't really want to read the list of
exploits, it's just too scary. :-)   :-|

> Please see our blog for guidance on what to use inside the browser, and to
> understand the differences between the various native XML products:
<http://blogs.msdn.com/xmlteam/archive/2006/10/23/using-the-right-version-of-msxml-in-internet-explorer.aspx>

I respect your freedom to express your point of you, but it is not
acceptable for the programming practice - this is the opinion I reserve
to hold.

The common approach, not only for MSXML is to try to get the best and
the most secure first and if failed then consecutively try to get
something less up to the fall-back minimum limit.