Improve security with simplexml - php

Question

I have a xml document and with simplexml i can easily parse into what i want.
My Xml:
<?xml version="1.0" encoding="UTF-8"?>
<noticias>
<noticia url="noticia-1">
<titulo>título da notícia 1</titulo>
<desc>some description</desc>
<texto>some text here</texto>
<img>filename here</img>
<in>some reference to where it came from</in>
</noticia>
...
</noticias>
PHP simplexml parser
$file = 'xml/noticias.xml';
if(file_exists($file)) {
$xml = simplexml_load_file($file);
foreach($xml as $item) {
$url = $item['url'];
$titulo = $item->titulo;
...
echo '<div><h2>'.$titulo.'</h2></div>';
}
}
My question is: is this secure? How can i improve security?
Thanks in advance.

Answer 1

It is not. However the problem in your source is not related to SimpleXML. You output a string value from an external data source (an XML file) as HTML source. This allows for something called an HTML injection. It can just break your output or let it be manipulated without the user actually noticing.
Here is a small example based on your source:
$xmlString = <<<'XML'
<noticias>
<noticia url="noticia-1">
<titulo>título da <i>notícia</i> 1</titulo>
</noticia>
</noticias>
XML;
$xml = simplexml_load_string($xmlString);
foreach($xml->noticia as $item) {
$titulo = $item->titulo;
echo '<div><h2>'.$titulo.'</h2></div>';
}
Output:
<div><h2>título da <i>notícia</i> 1</h2></div>
The i elements are text content in the XML, but HTML source in the output. A part of the title will be rendered italic in the browser. This is an harmless example for an HTML injection, but imagine someone with a not so nice intent.
If you output any value to HTML, make sure to escape special characters with htmlspecialchars() or use an API (like DOM) that does the escaping for you.