XML Injection

Also Known As

TL;DR

Explanation

XML injection occurs when user-controlled data is embedded in XML without proper escaping, allowing attackers to insert new elements, attributes, or entire document fragments. In SOAP services and XML configuration files this can alter application logic, inject malicious instructions, or escalate to XXE if the parser resolves external entities. Mitigate by using XML libraries that build documents programmatically rather than via string concatenation, and by encoding user data with htmlspecialchars() or dedicated XML-escaping functions.

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Building XML documents by string concatenation with user input instead of using DOMDocument.
• Not escaping <, >, &, ', " in values placed into XML — any of these can break structure.
• Trusting that XML user input is safe after HTML encoding — the escaping contexts differ.
• Adding user input to XML attributes without quoting and escaping the attribute delimiter.

Avoid When

• Never construct XML by string concatenation with user-supplied values.
• Do not assume XML output is safe because the input was validated — encoding must happen at output time.

When To Use

• Escape all user input with htmlspecialchars() or an XML-aware encoder before embedding in XML documents.
• Use DOMDocument to build XML programmatically — never concatenate user input into XML strings.

Code Examples

// User input concatenated into XML — injects nodes
\$xml = "<user><name>\$name</name></user>";
// name = </name></user><admin>true</admin><name>x

// Use DOM API — escaping is automatic
\$doc  = new DOMDocument();
\$user = \$doc->createElement('user');
\$elem = \$doc->createElement('name');
\$elem->appendChild(\$doc->createTextNode(\$userInput)); // auto-escaped
\$user->appendChild(\$elem);
\$doc->appendChild(\$user);
echo \$doc->saveXML();

// Or escape manually for XML context:
\$safe = htmlspecialchars(\$userInput, ENT_XML1 | ENT_QUOTES, 'UTF-8');

References

• ↗ https://owasp.org/www-community/attacks/XML_Injection

Tags

Related Terms