README

A PHP 8.1+ library for reading, creating, editing, encrypting, and decrypting Open Packaging Conventions (OPC) packages used by DOCX, XLSX, and PPTX files.

The library works with package-level concepts—parts, content types, and relationships. It does not model WordprocessingML, SpreadsheetML, or PresentationML documents.

Features

Read, create, and atomically update OPC packages.
Lazily stream large images and embedded files without keeping them in PHP strings.
Pass unchanged parts to path-based consumers through zip:// URIs, with automatic package-owned local materialization when a native URI is unavailable.
Navigate and modify package-level and part-level relationships.
Inspect OPC digital-signature parts and references without claiming cryptographic verification.
Explicitly remove signature material when producing an unsigned copy.
Detect ZIP, CFBF/OLE, encrypted OOXML, and unknown containers.
Read Agile and Standard Office encryption and write modern Agile encryption.
Apply configurable limits to untrusted ZIP and encrypted input.
Reject unsafe paths, duplicate entries, DTDs, malformed metadata, and modified ciphertext.

Requirements

PHP 8.1 or newer;
DOM extension;
ZIP extension.

Encryption additionally requires the OpenSSL extension and dkulyk/compound-file:^0.2.

Installation

composer require dkulyk/openxml-package

For encrypted Office files, also install the optional CFBF implementation:

composer require dkulyk/compound-file:^0.2

Quick start

Open a package and follow its office-document relationship:

use DK\OpenXml\OpenXmlPackage;
use DK\OpenXml\Packaging\RelationshipType;

$package = OpenXmlPackage::open('document.docx');

$document = $package
    ->getRelationships()
    ->firstByType(RelationshipType::OFFICE_DOCUMENT)
    ?->getTargetPart();

$xml = $document?->getContents();

Create and save a minimal package:

$package = OpenXmlPackage::create();

$document = $package->addPart(
    '/word/document.xml',
    'application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml',
    '<w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"/>',
);

$package->addRelationship(
    RelationshipType::OFFICE_DOCUMENT,
    'word/document.xml',
);

$package->saveAs('document.docx');

Changes to an opened package stay staged until save() or saveAs() succeeds. The destination is replaced atomically; validation and write failures leave the existing file untouched.

OpenXmlPackage::edit('document.docx', function (OpenXmlPackage $package): void {
    $package->getPart('/word/document.xml')->setContents('<updated/>');
});

Documentation

Working with packages — parts, streams, relationships, atomic edits, and the public packaging API.
Encryption and file detection — container routing, encryption support, and password-protected Office files.
Digital signatures — structural inspection, reported metadata, trust boundaries, and save behavior.
Security and limits — safe processing of untrusted files and current validation boundaries.
Architecture — package layers, internal ZIP boundary, extension points, and current limitations.
Contributing — development setup, tests, benchmarks, and pull-request expectations.
Security policy — supported versions and private reporting.

Development

composer install
composer check
composer benchmark

composer check runs Composer validation, syntax checks, PHP CS Fixer, PHPStan at level max, and PHPUnit. CI additionally audits locked dependencies and covers PHP 8.1–8.5, lowest supported dependencies, and Windows. Scheduled workflows exercise LibreOffice interoperability and publish package benchmark results.

License

DK OpenXml Package is open-source software licensed under the MIT License.

dkulyk / openxml

Maintainers

Package info

Statistics

Security