XML works great, but I don't know how I could store it securely on a remote server.
With my limited experience, I would do it like this:
On the server side I would limit the access to the XML file only to specific IP addresses and on the client side I would encrypt the XML file before it is uploaded to the server. However, I don't know if that's the best way to get it done.
Do you need to encrypt it at all? Correct me if I'm wrong, but essentially it is a game save? Providing there isn't any sensitive information contained in it (passwords, contact information, credit cards etc.) I wouldn't stress about encryption, at least from client to server.
Or are you worried about people getting in and modifying it while its on the server? In that case yes, you should certainly limit who & what can access your data/databases, and it should be standard practice. Otherwise you will find all kinds of nasty things happening when you aren't looking, such as your data disappearing completely. But once again I wouldn't panic about encryption, as people should be stopped from accessing it well before encryption comes in to play.
If however you do need to encrypt it for whatever reason, there are a few things to keep in mind. (This is a topic and field of study of its own, of which I know bugger all, but others on here might). If people have access to your client-side application, there is nothing stoping them from decompling it, wading through obfuscation if present, and nutting out your encryption method, and ultimately decoding your file. If the encryption is weak, it will just slow them down a bit. As such you should consider encrypting it again on the server prior to storage, using a different key or method (with the expense of extra performance overhead). You should also be thinking towards using SSL for transmitting the data if it is sensitive, to prevent interception.
But before you do anything like that, consider if 1) Would people would want to intercept & decode the file in the first place, and 2) what are the consequences if they did?