- var_dump: documentation ( source)
- simplexml_load_string: documentation ( source)
<?php
$buffer = <<<XML
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "data://text/html,aaaa" >]><foo>&xxe;</foo>
XML;
//libxml_disable_entity_loader(false);
$xml = simplexml_load_string($buffer);
var_dump($xml);
echo "trying New SimpleXMLElement($xml)";
$xml = new SimpleXMLElement($buffer);
var_dump($xml);
echo 'Enabling LIBXML_NOENT for test reasons';
$xml = simplexml_load_string($buffer, 'SimpleXMLElement', LIBXML_NOENT);
var_dump($xml);