You can try PEAR's XML/Parser.php but it relies on the xml extension (which relies on expat) but I belive that the xml extension is part of the default install now. Anyway, try using any of the xml functions to test it them and make a decision.
if (function_exists('xml_parser_create')) print "OK\n";
critical configuration variables -- such as the database url, username and passsword
One thing to realize is that anyone can make a request for an xml file from their browser so if you do use this for sensitive information then you'll have to protect it. Try putting it outside of your $DOCUMENT_ROOT.