[Name] expandEntities [Values] true or false [Description] if set to true ignore all entity declarations, and expand only the predefined entites (lt, gt, amp, apos, quot) and character references. (Entity declarations are potential attack points, [BradHill] mentions an entity that is 2 GB is length, also expanding external entities can lead to cross site scripting attacks) [Default] 
true
f a l s e
e m p t y
t r u e
X M L
n o n e
c o m b i n e
i n h e r i t