Use the XML_PARSE_NONET option to prevent parameter entity SSRF and XXE