MYSQL for sure for the backend. You don't have to deal with filelocking the XML file then. Security is something that you'll have account for either way. There both relatively easy, but I would want to use XML for large data because it isn't indexed like mysql is, unless you wrote an indexer. Disk Space is about the same for storage, but MYSQL itself as a program is moderate in size.
As others have said, for non-trivial multi-user, you really need the sharing features of a database.
I suggest that you look into a pure Java database like HyperSQL or Derby. They have Java-embedding and many other features that MySQL doesn't touch, and HyperSQL 2.0 (GA due out in few days) has SQL and JDBC support years ahead of MySQL.
My sql however can be simply accesd from any php or other system, while the pure java engines are probably a bit more difficult to embed on the site. (Registering, dunno what you plan, but something like items or any other api, i kinda think that eve-online shows what a intelligent api can be used for)
MySQL is used to back a lot large games, WoW to name one, with no real issues.
For all our mobile phone games we use MySQL.
Also depends on your design, if your game is far more read intensive than it is write, you can take advantage of MySQL replication and use slaves.
It's also been in development far longer and has much superior documentation than anything else save maybe Oracle.
If you don't need all that or if your game really isn't that hardcore, you might want to look at something like sqlite that will give you speed advantages over any daemon process though it has a bit steeper learning curve.