Why do they say that XML provides type safety and how is it expressed in the XML itself?
How is it different from JSON (for example) which (as I understand) is not type safe?
Because of the XML Schema Definition (XSD).
With XML, you can have an additional file which describes the schema. It indicates, for example, that the element
/a/b is an array and contains from 1 to 10 elements, or that the element
/a/c is an integer. You can find an example of an XSD here.
Validation of a given XML file through an XSD is supported by many languages. For example, a .NET application may request an XML file from an untrusted source and check that it matches the XSD; then, it can save it to a Microsoft SQL Server database, which can in turn contains an XSD and do the check again (to ensure that any client which have access to the database complies).
XSD is not the only language.
If you've done web development, you certainly heard about Document Type Definition (DTD)—a markup language which defines the structure of XML and is used especially in validation of HTML-related content. While it cannot do all things XSD can, such as ensure that an element or an attribute contains an integer number, it can still perform a bunch of structure checks.
RELAX NG has a benefit of being relatively simple compared to other languages and can be written in a more compact form than XML.
Schematron is another “rule-based validation language for making assertions about the presence or absence of patterns in XML trees” (Wikipedia) and presents a slightly different approach, based on XPath assertions.
Similar initiatives for JSON are not that popular (especially, I believe, in Microsoft-centric corporate world). One of the reasons is that JSON is intended for situations where the data structure is rather basic (i.e. can be expressed as a tree, without the need for attributes, for instance) and don't necessarily need to be validated. An excellent example is a REST API used by a dynamically-typed language:
/something/percentageis an actual number and is in 0..100 range).
XML can be type safe, since it it possible with XSD schemas to declare the data type of elements. A document validated against a XSD schema is guaranteed to conform to the expected types. But a XML format is not required to have a schema, so a document is not automatically type safe just by being XML.
There actually exist a schema language for JSON also, so type safe JSON is possible. But it is rarely used, so typically JSON is not type safe.
In computer science, type safety is the extent to which a programming language discourages or prevents type errors.
Type safety is not an absolute attribute. It is not boolean. Languages (and XML and JSON are languages) allow and prevent different kinds of errors and mistakes. For example you can misname elements. But you cannot skip required syntactic elements such as closing tags and braces.
Plain XML and JSON are pretty much equally type-safe (or type-unsafe). A valid XML/JSON string has a certain syntactic and semantic structure but this almost never is enough for an application to work with it. Applications don't just any a structure but a specific one.
XML shines with XML Schema Definition (XSD) which is a flexible and powerful way to validate a given XML document against a schema. This provides a lot of type safety under the definition given above.