Use of deprecated libxml_disable_entity_loader() PHP-W1086
Security
Major
a05
cwe-611
cwe-776
sans top 25
owasp top 10
The libxml_disable_entity_loader() function has been deprecated since PHP 8.0.0. Relying on this function is highly discouraged. It is recommended to use libxml_set_external_entity_loader() to suppress loading of external entities.
Bad practice
libxml_disable_entity_loader(false);
$domdocument = new DOMDocument();
$domdocument->load(file_get_contents('book.xml'));
echo $domdocument->saveXML();
Recommended
libxml_set_external_entity_loader(function() {
return null;
});
$domdocument = new DOMDocument();
$domdocument->load(file_get_contents('book.xml'));
echo $domdocument->saveXML();