there is an attribute in .net to serialize all your attributes... "long" type may not be serializable by default (no idea why)... example : [XmlRootAttribute("item", IsNullable = false)] public class MenuData { [XmlAttribute("Label")] public string MenuLabel = string.Empty; [XmlAttribute("Link")] public string MenuLink = string.Empty; [XmlArrayAttribute("Links", IsNullable=false)] public string[] MenuLinks; public MenuData() { } } [XmlRootAttribute("Menu", IsNullable = false )] public class Menu { [XmlArrayAttribute("Items")] public MenuData []MenuItems; public Menu() { } } public void SaveMenu() { XmlSerializer serializer = new XmlSerializer(typeof(Menu)); TextWriter writer = new StreamWriter(MenuFile); serializer.Serialize(writer, myMenu); writer.Close(); } private void GetMenu() { XmlSerializer serializer = new XmlSerializer(typeof(Menu)); FileStream fs = new FileStream(MenuFile, FileMode.Open,System.IO.FileAccess.Read); myMenu = (Menu)serializer.Deserialize(fs); fs.Close(); } ouput will be something like : <?xml version="1.0" encoding="utf-8"?> <Menu xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <Items> <MenuData Label="Quit" Link="/logoff.aspx" /> <MenuData Label="Notify users" Link="/notify.aspx" /> <MenuData Label="Admin" Link="/admin/login.aspx"> <Links> <string>/admin/subpage.aspx</string> <string>/admin/otherpage.aspx</string> </Links> </MenuData> <MenuData Label="Users" Link="/userlist.aspx" /> </Items> </Menu> this works..... I don't see any security issue !! some attributes won't be serializable by default...