laminas/laminas-xml
Secure XML utilities for PHP: parse and validate XML with safe defaults, mitigate XXE/XEE attacks, and control external entity loading. Helpful for apps that consume untrusted XML and need hardened DOM/LibXML configuration.
Installation
composer require laminas/laminas-xml:^1.8
Ensure your project supports PHP 8.5 (minimum requirement for this version).
Add to composer.json under require if not using Composer globally.
First Use Case: Parsing XML
use Laminas\Xml\Reader;
$reader = new Reader();
$reader->open('data.xml');
while ($reader->read()) {
if ($reader->nodeType === Reader::ELEMENT) {
echo $reader->name . "\n";
}
}
Where to Look First
src/ directory for core classes (Reader, Writer, Dom, Soap, etc.)tests/ for usage examples and edge cases.XML Parsing with Reader
$reader = new Reader();
$reader->open('config.xml');
$config = [];
while ($reader->read()) {
if ($reader->nodeType === Reader::ELEMENT && $reader->depth === 1) {
$config[$reader->name] = $reader->readString();
}
}
Generating XML with Writer
$writer = new Writer();
$writer->openMemory();
$writer->startElement('root');
$writer->writeElement('title', 'Sample');
$writer->writeElement('author', 'Laminas');
$writer->endElement();
$xml = $writer->saveXML();
DOM Manipulation
Laminas\Xml\Dom for complex XML transformations.$dom = new \Laminas\Xml\Dom('data.xml');
$nodes = $dom->getElementsByTagName('item');
foreach ($nodes as $node) {
$node->setAttribute('processed', 'true');
}
SOAP Integration
use Laminas\Xml\Soap\Client;
$client = new Client('http://example.com/soap?wsdl');
$response = $client->__soapCall('getData', [$params]);
Validation and Security
$reader = new Reader();
$reader->setOptions([
Reader::OPTION_DISABLE_EXTERNAL_ENTITIES => true,
]);
$reader->open('user-uploaded.xml');
Laminas\Xml\* interfaces to Laravel’s container for dependency injection.
$this->app->bind(\Laminas\Xml\Reader::class, function () {
return new \Laminas\Xml\Reader();
});
XXE Vulnerabilities
$reader->setOptions([Reader::OPTION_DISABLE_EXTERNAL_ENTITIES => true]);
Memory Limits
memory_limit. Use Reader for streaming:
$reader->open('large-file.xml');
while ($reader->read()) { /* Process incrementally */ }
Namespace Handling
DomXPath for robust queries:
$xpath = new \DomXPath($dom);
$nodes = $xpath->query('//ns:item', $dom->ownerDocument);
SOAP Quirks
$client = new Client('wsdl.url', [
'cache_wsdl' => WSDL_CACHE_NONE,
'trace' => 1,
]);
Encoding Issues
$writer->openMemory();
$writer->writeDeclaration('1.0', 'UTF-8');
PHP 8.5 Compatibility
match, fn).$reader->setOptions([Reader::OPTION_DEBUG => true]);
Laminas\Xml\Validator or xmllint CLI tool:
xmllint --noout --schema schema.xsd data.xml
try {
$reader->open('data.xml');
} catch (\Laminas\Xml\Exception\RuntimeException $e) {
Log::error('XML error: ' . $e->getMessage());
}
Custom Writers/Readers
Extend Laminas\Xml\Writer or Reader for domain-specific logic:
class MyXmlWriter extends \Laminas\Xml\Writer {
public function writeCustomElement(string $name, array $data) {
$this->startElement($name);
foreach ($data as $key => $value) {
$this->writeElement($key, $value);
}
$this->endElement();
}
}
Event Dispatching Integrate with Laravel Events for XML lifecycle hooks:
event(new XmlParsed($reader, $data));
Caching Parsed XML
Cache DomDocument or parsed arrays to avoid reprocessing:
$cacheKey = 'xml_data_' . md5($filePath);
$data = Cache::remember($cacheKey, 3600, function () use ($reader) {
return $this->parseXml($reader);
});
Testing
Mock Reader/Writer in PHPUnit for isolated tests:
$mockReader = $this->createMock(\Laminas\Xml\Reader::class);
$mockReader->method('read')->willReturnOnConsecutiveCalls(
['nodeType' => \Laminas\Xml\Reader::ELEMENT, 'name' => 'test']
);
PHP 8.5 Optimizations
How can I help you explore Laravel packages today?