I've used a lot of content management systems in my day (drupal, wordpress, joomla, etc.) and they have all been database driven using MySQL. While the security updates for many CMS offerings out there seem frequent and strong, I still see the occasional site go down, get defaced, etc. (usually from SQL injection attacks).

This has led me to look at Get-Simple CMS, which has the unique difference of housing data in XML files. I realize folks won't be able to speak about specific vulnerabilities related to this CMS, but in general what are the pros and cons with regard to security and an XML driven CMS?

  • I don't think this needs to be community wiki
    – John Conde
    Oct 11, 2010 at 13:54
  • how do i remove it? Oct 12, 2010 at 19:24

1 Answer 1


It's really the same as any form of data store. Do you protect it from malicious data and attack? One thing that comes to mind is how are the XML files stored?

  • Outside of the web root - best
  • Inside the web root but protected through .htaccess - not as good but ok
  • Inside the web root and hidden through obscurity - not good at all

The data's integrity and malicious user input issues still apply. They may not be able to to SQL injections but they can still do XXS attacks as that is independent of the storage mechanism.

I'd have to say there is no advantage or disadvantage to using XML for storage from a security point of view. (From a non-security point of view I would think XML is slower to work with then a relational database especially for large data stores).

  • Thanks! You're definitely right about the speed issue, but I'm using it for smallish sites anyhow. My math was that the risk of injections + XSS (traditional CMS) was greater than risk of XSS (XML CMS). Oct 11, 2010 at 14:01
  • If the CMS is established the odds are any SQL injection vulnerabilities would have been exposed and fixed by now. So unless you're rolling your own CMS I wouldn't let something like that be a factor in your decision.
    – John Conde
    Oct 11, 2010 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.