Utility library for XML usage, best practices, and security in PHP

Fund package maintenance!
Community Bridge

Installs: 468 797

Dependents: 13

Suggesters: 0

Security: 0

Stars: 12

Watchers: 14

Forks: 5

Open Issues: 1

1.3.1 2021-02-17 22:44 UTC

This package is auto-updated.

Last update: 2021-10-04 21:01:40 UTC


This package is considered feature-complete, and is now in security-only maintenance mode, following a decision by the Technical Steering Committee. If you have a security issue, please follow our security reporting guidelines. If you wish to take on the role of maintainer, please nominate yourself

Build Status

An utility component for XML usage and best practices in PHP


You can install using:

$ curl -s | php
$ php composer.phar install

Notice that this library doesn't have any external dependencies, the usage of composer is for autoloading and standard purpose.


This is a security component to prevent XML eXternal Entity (XXE) and XML Entity Expansion (XEE) attacks on XML documents.

The XXE attack is prevented disabling the load of external entities in the libxml library used by PHP, using the function libxml_disable_entity_loader.

The XEE attack is prevented looking inside the XML document for ENTITY usage. If the XML document uses ENTITY the library throw an Exception.

We have two static methods to scan and load XML document from a string (scan) and from a file (scanFile). You can decide to get a SimpleXMLElement or DOMDocument as result, using the following use cases:

use Laminas\Xml\Security as XmlSecurity;

$xml = <<<XML
    <?xml version="1.0"?>

// SimpleXML use case
$simplexml = XmlSecurity::scan($xml);
printf ("SimpleXMLElement: %s\n", ($simplexml instanceof \SimpleXMLElement) ? 'yes' : 'no');

// DOMDocument use case
$dom = new \DOMDocument('1.0');
$dom = XmlSecurity::scan($xml, $dom);
printf ("DOMDocument: %s\n", ($dom instanceof \DOMDocument) ? 'yes' : 'no');