Injection Attacks: The Complete 2020 Guide

XXE Injections - Overview

Disable DTDs, External Entities, and External DTDs

Disable DTDs completely

If you can't, then you should at least disable external entities and external DTDs

Disable DTDs, External Entities, and External DTDs

Disabling depends on the parser and language being used...

For PHP, you could do it with:

Disable DTDs, External Entities, and External DTDs

For more languages and info:

https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

Verify XML file uploads

How to handle file uploads:

https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html

Use alternatives to XML

ie: JSON or YAML

Find XXE vulnerabilities in your apps