close potential XXE security issue (CVE-2014-2053)

http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html
replace double-quoted strings with single-quoted