PHP ZIP Archives

How it works

ZipArchive is the modern extension API used here. A production importer needs limits for entry count, individual size, total expanded size and approved path shapes. Reject traversal segments and consider symlinks before extraction; a filename extension alone does not establish safety. This lab creates its own tiny archive and reads one fixed entry without performing a general extraction.

Run it locally

Run this complete source locally with PHP 8.2 or newer. Save it using the filename shown and run the command below. PHP is not currently available in Bhylu’s browser playground. Apache and MySQL are not needed for an ordinary CLI example.

Required extension: zip. Check php -m for your own interpreter.

php -l archives.php
php archives.php

Download this source as a local PHP lab file. Keep lab files separate from the Bhylu project and production data.

Example

<?php
declare(strict_types=1);

$file = tempnam(sys_get_temp_dir(), "bhylu-zip-");
if ($file === false) throw new RuntimeException("Cannot allocate archive path");
unlink($file);
try {
    $zip = new ZipArchive();
    if ($zip->open($file, ZipArchive::CREATE) !== true) throw new RuntimeException("Cannot create archive");
    $zip->addFromString("notes/readme.txt", "Return tools clean"); $zip->close();
    if ($zip->open($file) !== true) throw new RuntimeException("Cannot reopen archive");
    try { echo $zip->getFromName("notes/readme.txt"), "\n"; } finally { $zip->close(); }
} finally { if (is_file($file)) unlink($file); }

Expected result

Return tools clean

The archive and its entry names are controlled fixtures. Reopening verifies a stored round trip, and both the archive handle and temporary path are cleaned up. This does not exercise an attacker-supplied compressed bomb or prove that extractTo is safe for arbitrary uploads.