- var_dump: documentation ( source)
- simplexml_load_string: documentation ( source)
- libxml_disable_entity_loader: documentation ( source)
<?php
$buffer = <<<XML
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "data://text/html,aaaa" >]><foo>&xxe;</foo>
XML;
libxml_disable_entity_loader(true);
$xml = simplexml_load_string($buffer);
var_dump($xml);
echo "trying New SimpleXMLElement($xml)";
$xml = new SimpleXMLElement($buffer);
var_dump($xml);
echo 'Enabling LIBXML_NOENT for test reasons';
$xml = simplexml_load_string($buffer, 'SimpleXMLElement', LIBXML_NOENT);
var_dump($xml);