PHP SimpleXML

How it works

Use explicit parser flags and avoid enabling external entity substitution for untrusted XML. A real import also needs a byte-size limit, schema/shape validation and a policy for parser errors. LIBXML_NONET prevents network access through supported libxml behaviour, but is not a blanket guarantee against every dangerous parser option. The fixture contains no DTD or external resources and is created entirely in this file.

Run it locally

Run this complete source locally with PHP 8.2 or newer. Save it using the filename shown and run the command below. PHP is not currently available in Bhylu’s browser playground. Apache and MySQL are not needed for an ordinary CLI example.

Required extension: SimpleXML. Check php -m for your own interpreter.

php -l simplexml.php
php simplexml.php

Download this source as a local PHP lab file. Keep lab files separate from the Bhylu project and production data.

Example

<?php
declare(strict_types=1);

$source = '<loans><loan id="71"><item>Spade</item><quantity>2</quantity></loan></loans>';
$previous = libxml_use_internal_errors(true);
try {
    $xml = simplexml_load_string($source,SimpleXMLElement::class,LIBXML_NONET);
    if ($xml === false) throw new RuntimeException("Invalid XML");
    foreach ($xml->loan as $loan) echo (string)$loan["id"], ": ", (string)$loan->item, "\n";
} finally { libxml_clear_errors(); libxml_use_internal_errors($previous); }

Expected result

71: Spade

Attribute access retrieves the ID while child-element access retrieves the item text. SimpleXML nodes are objects, so explicit string conversion clarifies the intended field representation. The quantity remains text and needs its own positive-integer rule. Parser diagnostics are kept local instead of leaking paths or raw imported content to a visitor.