- How do I install mtownsend/request-xml in a Laravel app?
- Install it with composer require mtownsend/request-xml. Laravel package auto-discovery registers the service provider, so there is no config file to publish, no migrations, and no manual bootstrapping. Confirm that ext-simplexml is enabled in your PHP build, since minimal or hardened container images sometimes omit it.
- How do I parse an XML request body in a Laravel controller?
- In a controller, call $request->xml() to receive the parsed XML body as a PHP array, mirroring the ergonomics of $request->json(). The macro is registered on Laravel's Request facade, so it works anywhere you already have a request instance. No middleware or container binding is needed.
- Which Laravel and PHP versions does mtownsend/request-xml support?
- The package targets Laravel applications from the 5.5 era onward that use package auto-discovery, because the Request macro pattern is stable across those releases. Always check the composer.json constraints for the exact Laravel and PHP versions supported by the release you install. If you are on an older or heavily customized framework version, verify Request::macro compatibility first.
- Is mtownsend/request-xml safe against XXE and XML entity attacks?
- XML parsing with SimpleXML is only safe when the parser is hardened, so inspect the source before adoption. You want parsing with LIBXML_NONET and without LIBXML_NOENT to block external entity and DTD retrieval. Also consider protections against entity-expansion denial of service such as billion laughs. If you cannot verify this in the code, wrap or fork the parser with your own libxml options.
- What does $request->xml() return when the XML is malformed?
- The exact return contract on malformed XML is not clearly documented, so treat it as something to verify in your own tests rather than assume. Depending on implementation it may throw an exception, return null, or yield an empty array. Wrap the call in your own validation and error handling if invalid XML is a realistic input for your endpoint.
- How are XML attributes and namespaces represented in the parsed array?
- Mapping XML to a flat array is lossy by nature: namespaces can collapse or collide, attributes have no natural representation, and repeated siblings often surface as singular versus plural keys. Mixed content and CDATA handling also depend on libxml flags such as LIBXML_NOCDATA. Test the output against your partner's actual schema before shipping.
- Can mtownsend/request-xml handle large XML payloads?
- SimpleXML materializes the whole document in memory, so this package is not suitable for multi-megabyte XML payloads. For large documents, use a streaming parser such as XMLReader instead. Keep request-xml for ordinary-sized inbound HTTP XML where an array is convenient.
- Does mtownsend/request-xml work with SOAP APIs?
- The package is aimed at inbound XML HTTP request bodies, including legacy or SOAP-style partner APIs that post XML. It is not a SOAP client and does not handle WSDL, envelopes, or XML responses. Pair it with a dedicated WSDL client for SOAP and with a resource or serializer for XML output.
- Will $request->xml() collide with my existing macros or legacy XML handling?
- The package is additive and registers a macro on the Request facade, so it does not replace middleware or change the request lifecycle. That said, check whether a $request->xml() macro already exists in your app or dependencies, because a later registration can collide. Migrate legacy simplexml_load_string calls or private XML traits one endpoint at a time to limit the blast radius.
- Is mtownsend/request-xml actively maintained and safe for long-term production use?
- The project is effectively single-maintainer with a small user base, so consider bus factor in your long-term support planning. The MIT license and roughly 100 lines of logic make a vendored fork straightforward if the package stalls. Pin a known-good version and keep your own tests around the parsing behavior you depend on.