Req #81210 [Com]: Disable XML External Entities by config

Edit report at https://bugs.php.net/bug.php?id=81210&edit=1 ID: 81210 Comment by: rtrtrtrtrt at dfdfdfdf dot dfd Reported by: mail at 12live dot de Summary: Disable XML External Entities by config Status: Open Type: Feature/Change Request Package: PHP options/info functions PHP Version: Irrelevant Block user comment: N Private report: N New Comment: such switches are a terrible idea because you can't know where your code will run in the future - instead write good code you rely on luck of a server config which could change tomorrow Previous Comments: ------------------------------------------------------------------------ [2021-06-30 11:29:11] mail at 12live dot de Description: ------------ As XML External Entity is still a serious security risk, i would like to have the ini option to disable this globally PHP level. Ideally it would be disabled by default (as GO does) but I can understand if this is not feasible. At least not if PHP claims to be XML standard compliant by default. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=81210&edit=1