You would definitly want PHP to write to the XML file, because you can do security checks. Javascript is entirely client-side, meaning anyone can reverse engineer it and get the info they need to write spam to your XML file without restriction (or worse, erase it).
Databaseless chat, huh? What's the aversion to the database?
Is this why you wanted that "
security mod" with flock?