PHPKonf 2020 Online


(PHP 5 >= 5.2.11, PHP 7)

libxml_disable_entity_loaderDisable the ability to load external entities


libxml_disable_entity_loader ([ bool $disable = TRUE ] ) : bool

Disable/enable the ability to load external entities. Note that disabling the loading of external entities may cause general issues with loading XML documents. However, as of libxml 2.9.0 entity substitution is disabled by default, so there is no need to disable the loading of external entities.



Disable (TRUE) or enable (FALSE) libxml extensions (such as DOM, XMLWriter and XMLReader) to load external entities.

Valorile întoarse

Returns the previous value.

A se vedea și

add a note add a note

User Contributed Notes 5 notes

vavra at 602 dot cz
2 years ago
If is called

, it causes that new SoapClient(.) fails with

SOAP-ERROR: Parsing WSDL: Couldn't load from 'D:\path/dm_operations.wsdl' : failed to load external entity "D:\path/dm_operations.wsdl

because this wsdl imports a xsd as an another external file.
Tested on php 7.1.12, win x64.
8 years ago
Using this function you can prevent a vulnerable to Local and Remote File Inclusion attacks.

You'll see it in an example where I load and validate the following string:

<!DOCTYPE scan [<!ENTITY test SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">]>

One way to prevent that the file in given back is to set this value to 0.
Please take a closer look at the release of symfony 2.0.11
phofstetter at sensational dot ch
6 years ago
Be mindful that this also disables url loading in simplexml_load_file() and likely other libxml based functions that deal with URLs
brendan at bloodbone dot ws
6 years ago
This also seems to have an impact on <xsl:import /> statements if this is applied when loading XSLT for the XSLTProcessor class.
daschtour at me dot com
6 years ago
This function was reported to be not thread safe. So this might affect php-scripts on the same server.
To Top