diff --git a/reference/libxml/constants.xml b/reference/libxml/constants.xml
index 507946f3e5fd..261846565cda 100644
--- a/reference/libxml/constants.xml
+++ b/reference/libxml/constants.xml
@@ -46,6 +46,12 @@
Default DTD attributes
+
+
+ Enabling loading of DTD attributes will enable fetching of external entities.
+ The LIBXML_NO_XXE constant can be used to prevent this (only available in Libxml >= 2.13.0, as of PHP 8.4.0).
+
+
@@ -57,6 +63,12 @@
Load the external subset
+
+
+ Enabling loading of external subsets will enable fetching of external entities.
+ The LIBXML_NO_XXE constant can be used to prevent this (only available in Libxml >= 2.13.0, as of PHP 8.4.0).
+
+
@@ -71,6 +83,7 @@
Enabling validating the DTD may facilitate XML External Entity (XXE) attacks.
+ The LIBXML_NO_XXE constant can be used to prevent this (only available in Libxml >= 2.13.0, as of PHP 8.4.0).
diff --git a/reference/libxml/functions/libxml-disable-entity-loader.xml b/reference/libxml/functions/libxml-disable-entity-loader.xml
index 8d9d4ab2e7e7..d4e605d92f60 100644
--- a/reference/libxml/functions/libxml-disable-entity-loader.xml
+++ b/reference/libxml/functions/libxml-disable-entity-loader.xml
@@ -20,12 +20,17 @@
Disable/enable the ability to load external entities.
Note that disabling the loading of external entities may cause general issues
- with loading XML documents. However, as of libxml 2.9.0 entity substitution
+ with loading XML documents.
+
+
+ As of libxml 2.9.0 entity substitution
is disabled by default, so there is no need to disable the loading of external
entities,
- unless there is the need to resolve internal entity references with LIBXML_NOENT.
+ unless there is the need to resolve internal entity references with LIBXML_NOENT,
+ LIBXML_DTDVALID, or LIBXML_DTDLOAD.
Generally, it is preferable to use libxml_set_external_entity_loader
to suppress loading of external entities.
+ The LIBXML_NO_XXE constant can be used to prevent this as well (only available in Libxml >= 2.13.0, as of PHP 8.4.0).
@@ -99,7 +104,9 @@
libxml_use_internal_errorslibxml_set_external_entity_loader
- The LIBXML_NOENT constant
+ The LIBXML_NOENT constant
+ The LIBXML_DTDVALID constant
+ The LIBXML_NO_XXE constant