XML injection and XXE – stronger together