Edit Report a Bug

    libxml_disable_entity_loader

    (PHP 5 >= 5.2.11, PHP 7, PHP 8)

    libxml_disable_entity_loader — Deshabilita la capacidad de cargar entidades externas

    Descripción

    libxml_disable_entity_loader(bool $disable = true): bool

    Habilita/deshabilita la capacidad de cargar entidades externas.

    Parámetros

    disable

    Deshabilita (true) o habilita (false) extensiones libxml (tal como DOM, XMLWriter y XMLReader) para cargar entidades externas.

    Valores devueltos

    Devuelve el valor anterior.

    Ver también

    add a note add a note

    User Contributed Notes 7 notes

    up
    7
    suconghou at gmail dot com
    3 years ago
    In PHP 8.0 and later, PHP uses libxml versions from 2.9.0, libxml_disable_entity_loader is deprecated.
    so it is now safe to remove all `libxml_disable_entity_loader` calls on php8

    if you want Backwards Compatibility

    use this snippet

    if (\PHP_VERSION_ID < 80000) {
        libxml_disable_entity_loader(true);
    }
    up
    8
    vavra at 602 dot cz
    6 years ago
    If is called
    libxml_disable_entity_loader(true);

    , it causes that new SoapClient(.) fails with

    SOAP-ERROR: Parsing WSDL: Couldn't load from 'D:\path/dm_operations.wsdl' : failed to load external entity "D:\path/dm_operations.wsdl

    because this wsdl imports a xsd as an another external file.
    Tested on php 7.1.12, win x64.
    up
    0
    editor at geekkb.com
    1 year ago
    There is an extra \ should be deleted before PHP_VERSION_ID in the code which suconghou posted 2 years ago.

    if (PHP_VERSION_ID < 80000) {
        libxml_disable_entity_loader(true);
    }
    up
    0
    phofstetter at sensational dot ch
    10 years ago
    Be mindful that this also disables url loading in simplexml_load_file() and likely other libxml based functions that deal with URLs
    up
    0
    simonsimcity
    12 years ago
    Using this function you can prevent a vulnerable to Local and Remote File Inclusion attacks.

    You'll see it in an example where I load and validate the following string:

    <!DOCTYPE scan [<!ENTITY test SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">]>
    <scan>&test;</scan>

    One way to prevent that the file in given back is to set this value to 0.
    Please take a closer look at the release of symfony 2.0.11
    up
    -3
    brendan at bloodbone dot ws
    10 years ago
    This also seems to have an impact on <xsl:import /> statements if this is applied when loading XSLT for the XSLTProcessor class.
    up
    -7
    daschtour at me dot com
    10 years ago
    This function was reported to be not thread safe. So this might affect php-scripts on the same server.
    add a note add a note
    To Top