No External Entity References In Attribute Values

There's a good reason for this rule. XML goes to a lot of work to make external entities self-identifying and allowing them to use different character encodings; this is the reason for the text declaration. But an efficient XML processor is probably going to treat attribute values in quite a different way, and it's hard to figure out what the right way would be to deal with a text declaration in the middle of an attribute value.

So in XML, it's internal entities only in attribute values.

Back-link to spec