When you're designing your xfa-page, you choose a content-type to output something back to the user. It may be a PDF, or even an excel-sheet, but most often a html-page.
The content-types should only read from your db since they're avaliable at GET-request. (XSS security).
By the way, today is 2019-08-17.