Most XML libraries have an option to disable external entity loading. But this is not enough. Libraries should be secure by default, not by toggling an obscure

Most XML libraries have an option to disable external entity loading. But this is not enough. Libraries should be secure by default, not by toggling an obscure option. (On a related note, why do we still have so many templating engines that don't block XSS by default?) Recent versions of libxml (2.9.0+) disable external entity loading by default, so any implementation based on libxml (such as PHP's SimpleXML) should be secure as long as the defaults are left untouched. But if you use an XML parser implemented natively in another language, or one that links to an older version of libxml, you should look really carefully at the default settings.