I have PHP code that uses the loadXML function (as well as other XML functions).
Is the loadXML function vulnerable to XXE attack? Namely, if the XML contains external entities, will they be interpreted?
Is this function vulnerable to other XML based attacks? E.g., the Billion Laughs DoS attack?
Can you refer me to a list of functions that are vulnerable to XXE and to other XML-related attacks?
I know that it is possible to easily block XXE attacks in PHP by changing the settings. Yet, I will be glad to get answers to the questions I raised.