libxml_set_external_entity_loader()

libxml_set_external_entity_loader() — Changes the default external entity loader.

Built-in function of PHP 8.5. The manual lists it as available in PHP 5 >= 5.4.0, PHP 7, PHP 8. This page is the reference card: signature, parameters and return value, plus the changelog and the example the manual provides.

What it does

Changes the default external entity loader. This can be used to suppress the expansion of arbitrary external entities to avoid XXE attacks, even when LIBXML_NOENT has been set for the respective operation, and is usually preferable over calling libxml_disable_entity_loader().

Signature

libxml_set_external_entity_loader(?callable $resolver_function): true resolver(?string $public_id, string $system_id, array $context): resource|string|null

Parameters

Parameter	Type	What it takes
$resolver_function	?callable	A callable with the following signature: function resolver(?string $public_id, string $system_id, array $context): resource\|string\|null public_id The public ID. system_id The system ID. context An array with the four elements "directory", "intSubName", "extSubURI" and "extSubSystem". This callable should return a resource, a string from which a resource can be opened. If null is returned, the entity reference ...

Return value

Always returns true.

Example

A runnable snippet:

$xml = <<<XML <!DOCTYPE foo PUBLIC "-//FOO/BAR" "http://example.com/foobar"> <foo>bar</foo> XML; $dtd = <<<DTD <!ELEMENT foo (#PCDATA)> DTD; libxml_set_external_entity_loader( function ($public, $system, $context) use($dtd) { var_dump($public); var_dump($system); var_dump($context); $f = fopen("php://temp", "r+"); fwrite($f, $dtd); rewind($f); return $f; } ); $dd = new DOMDocument; $r = $dd->loadXML($xml); var_dump($dd->validate());

Output:

string(10) "-//FOO/BAR" string(25) "http://example.com/foobar" array(4) { ["directory"]=> NULL ["intSubName"]=> NULL ["extSubURI"]=> NULL ["extSubSystem"]=> NULL } bool(true)

Changelog

Version	Change
8.5.0	The return type is true now; previously, it was bool.