zendframework/zendxml

Utility library for XML usage, best practices, and security in PHP

ZendXml

Repository abandoned 2019-12-31

This repository has moved to laminas/laminas-xml., _(*1)

, _(*2)

An utility component for XML usage and best practices in PHP, _(*3)

Installation

You can install using:, _(*4)

curl -s https://getcomposer.org/installer | php
php composer.phar install

Notice that this library doesn't have any external dependencies, the usage of composer is for autoloading and standard purpose., _(*5)

ZendXml\Security

This is a security component to prevent XML eXternal Entity (XXE) and XML Entity Expansion (XEE) attacks on XML documents., _(*6)

The XXE attack is prevented disabling the load of external entities in the libxml library used by PHP, using the function libxml_disable_entity_loader., _(*7)

The XEE attack is prevented looking inside the XML document for ENTITY usage. If the XML document uses ENTITY the library throw an Exception., _(*8)

We have two static methods to scan and load XML document from a string (scan) and from a file (scanFile). You can decide to get a SimpleXMLElement or DOMDocument as result, using the following use cases:, _(*9)

use ZendXml\Security as XmlSecurity;

$xml = <<<XML
<?xml version="1.0"?>
<results>
    <result>test</result>
</results>
XML;

// SimpleXML use case
$simplexml = XmlSecurity::scan($xml);
printf ("SimpleXMLElement: %s\n", ($simplexml instanceof \SimpleXMLElement) ? 'yes' : 'no');

// DOMDocument use case
$dom = new \DOMDocument('1.0');
$dom = XmlSecurity::scan($xml, $dom);
printf ("DOMDocument: %s\n", ($dom instanceof \DOMDocument) ? 'yes' : 'no');