[Misha-]

SQLi is still possible with either of those enabled, what makes you think it can't be done?

XXE is also pretty worthless unless you're under the rare case that there are plaintext passwords stored somewhere. You can stop being a poser now.

Are you fucking high?
For the SQLi, the place where i'm injecting is encapsulated with ", which I can't break out of, because of addslashes()/magic_quotes.
You would've seen that if you even looked at the query.

As for the XXE, again, are you fucking high?
Please google what XXE is and come back.