PHP XML Responses

How it works

A browser client can fetch the endpoint and parse its XML deliberately. Avoid inserting the raw result into innerHTML. This fixture uses controlled data and an XML node API, then sets application/xml with UTF-8. A production representation still needs an authorisation and size policy and a stated schema for clients. JSON may be simpler for many new browser APIs, while XML remains useful for existing integrations.

Run it locally

Save this standalone lab file in a separate local folder. Start a PHP development server on an unused loopback port, for example php -S 127.0.0.1:8090 -t . . Open the shown filename through that server, not a file URL. Exercise GET and POST as described. This is not a POST endpoint on Bhylu, and the built-in development server is not a production server.

php -l xml-response.php
php -S 127.0.0.1:8090 -t .

Download this source as a local PHP lab file. Keep lab files separate from the Bhylu project and production data.

Example

<?php
declare(strict_types=1);

header("Content-Type: application/xml; charset=utf-8");
$document = new DOMDocument("1.0","UTF-8");
$root = $document->appendChild($document->createElement("items"));
$item = $root->appendChild($document->createElement("item"));
$item->appendChild($document->createTextNode("Rake & fork"));
echo $document->saveXML();

Expected result

An XML document containing <item>Rake &amp; fork</item>.

The text-node API represents the ampersand as document data instead of concatenating a malformed XML fragment. The response is not placed into an HTML page automatically. A client should inspect status/content type, parse the document and display chosen values through the appropriate text context.

Requests to check

• GET xml-response.php → status 200.

Use a local browser form or HTTP client. A CSRF token from one session does not authorise a different session. The automated review uses actual HTTP requests, not just command-line output.