---
title: "XmlSecurity – API-Referenz · Quittio"
description: "Safe XML loading for untrusted input."
canonical_url: "https://quittio.dev/docs/api/Quittio/Core/Xml/XmlSecurity"
locale: de
meta:
  "og:description": "Safe XML loading for untrusted input."
  "og:image": "https://quittio.dev/og/quittio-de.jpg"
  "og:image:alt": "Quittio: E-Rechnungen für PHP und Laravel. Rechtssicher, validiert, archiviert, mit geprüfter Beispielrechnung."
  "og:image:height": "630"
  "og:image:type": image/jpeg
  "og:image:width": "1200"
  "og:title": "XmlSecurity – API-Referenz · Quittio"
  "twitter:image": "https://quittio.dev/og/quittio-de.jpg"
  "twitter:image:alt": "Quittio: E-Rechnungen für PHP und Laravel. Rechtssicher, validiert, archiviert, mit geprüfter Beispielrechnung."
---

> Index of every page on this site: [llms.txt](https://quittio.dev/llms.txt)

[API reference](https://quittio.dev/docs/api) / [Quittio](https://quittio.dev/docs/api/Quittio) \\ [Core](https://quittio.dev/docs/api/Quittio/Core) \\ [Xml](https://quittio.dev/docs/api/Quittio/Core/Xml)

# XmlSecurity

final class in quittio/core

`Quittio\Core\Xml\XmlSecurity` · [Source](https://github.com/Quittio/quittio/blob/v0.7.1/packages/core/src/Xml/XmlSecurity.php#L22)

Safe XML loading for untrusted input.

- Documents with a DOCTYPE are rejected (no entity expansion, no XXE).
- No network access (LIBXML\_NONET), no entity substitution (no LIBXML\_NOENT).
- Size limit for the input.
- Start tags are limited in length and number of attributes: libxml2 before 2.12 checks attributes for duplicates in quadratic time.
- The number of namespace declarations in scope is limited: libxml2 before 2.12 looks up every prefix by a linear search through all declarations in scope.
- Only encodings in which the markup is ASCII (UTF-8, ISO-8859-*, windows-125*) and UTF-16 are accepted; UTF-7 or EBCDIC would hide the markup from these checks.

## Constants \#

| Constant | Value | Description |
| --- | --- | --- |
| `DEFAULT_MAX_BYTES` | `10 * 1024 * 1024` | |
| `MAX_ATTRIBUTES` | `256` | Maximum number of attributes (including namespace declarations) of a single element. |
| `MAX_NAMESPACES_IN_SCOPE` | `256` | Maximum number of namespace declarations in scope at any element. |
| `MAX_TAG_BYTES` | `64 * 1024` | Maximum length of a single start tag including its attributes. |

## Methods \#

| Method | Description |
| --- | --- |
| `::load()` | |

### `load()`#

```
public static function load(
    string $xml,
    int $maxBytes = self::DEFAULT_MAX_BYTES,
): DOMDocument
```

static

| Parameter | Type | Description |
| --- | --- | --- |
| `$xml` | `string` | |
| `$maxBytes` | `int` = `self::DEFAULT_MAX_BYTES` | |

<dl><dt>Returns</dt>
<dd><code>DOMDocument</code></dd>
</dl>

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://quittio.dev/#website","@type":"WebSite","description":"E-Rechnungen für PHP und Laravel: ZUGFeRD, XRechnung und Peppol erstellen, prüfen, lesen und archivieren.","inLanguage":"de-DE","name":"Quittio","url":"https://quittio.dev/","publisher":{"@id":"https://quittio.dev/#identity"},"workTranslation":{"@id":"https://quittio.dev/en#website"}},{"@id":"https://quittio.dev/docs/api/Quittio/Core/Xml/XmlSecurity#webpage","@type":"WebPage","description":"Safe XML loading for untrusted input.","name":"XmlSecurity – API-Referenz","url":"https://quittio.dev/docs/api/Quittio/Core/Xml/XmlSecurity","isPartOf":{"@id":"https://quittio.dev/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://quittio.dev/docs/api/Quittio/Core/Xml/XmlSecurity"]}],"primaryImageOfPage":{"@id":"https://quittio.dev/#logo"}},{"@id":"https://quittio.dev/#identity","@type":"Organization","description":"Open-Source-Bibliothek für E-Rechnungen in PHP und Laravel (ZUGFeRD, XRechnung, Peppol) und Quittio Managed.","email":"kontakt@niklasforst.de","legalName":"Niklas Forst – Softwareentwicklung","name":"Quittio","url":"https://quittio.dev","founder":{"@type":"Person","name":"Niklas Forst","url":"https://quittio.dev/ueber"},"logo":{"@id":"https://quittio.dev/#logo"},"sameAs":["https://github.com/Quittio/quittio","https://packagist.org/packages/quittio/quittio"]},{"@id":"https://quittio.dev/#logo","@type":"ImageObject","caption":"Quittio","contentUrl":"https://quittio.dev/logo.png","inLanguage":"de-DE","url":"https://quittio.dev/logo.png"}]}
```