XML Processing with DOM

A DOM document owns its nodes. An element can contain other elements and text nodes; an attribute belongs to an element. appendChild() places a node in a parent, and removeChild() removes a child from that parent. nodeValue and textContent describe content, while saveXML() serializes structure into XML syntax. A string containing '<b>Pen</b>' is not automatically a child element: treat it as text unless you deliberately parse and import markup under a trusted policy. createTextNode() makes that intent explicit and escapes characters when serialized. XML has a single document element, although processing instructions and comments may surround it. Check whether a queried node is present before accessing properties, because a valid document may not contain the business field you expected.

Construct an element with createElement(), attach attributes with setAttribute(), and add plain values through createTextNode(). This avoids manually replacing ampersands or angle brackets and avoids accidentally turning data into XML structure. For example, a product named 'Pen & Pad' should become text containing an ampersand, which the serializer represents as &amp;. Never concatenate an untrusted name directly into '<name>' plus the value plus '</name>'. A name containing markup could change the structure or produce invalid XML. Select an encoding and ensure your input strings actually use it; declaring UTF-8 does not repair arbitrary bytes. Decide whether to include an XML declaration when sending a document, and set an appropriate application/xml Content-Type before writing it to an HTTP response.

DOMDocument::loadXML() returns a boolean. A try/catch alone does not guarantee every malformed document becomes an exception, so check its result. Use libxml internal errors to keep parser diagnostics from mixing with the intended response, then clear and restore the error state. Reject an empty input before parsing because it has its own warning behavior. DOMXPath evaluates expressions against the tree and returns node selections for path queries. An expression such as /inventory/product[@code='0012'] can find the desired product, but request-supplied XPath fragments need their own safe construction policy. Prefer traversal or a correctly quoted literal over concatenating arbitrary input into an expression. Parsing success does not prove the inventory complies with your required schema.

DOMXPath needs a registered prefix for namespace-aware queries, including documents using a default namespace. Register your own prefix bound to the namespace URI; the source document's visible prefix does not have to match. createElementNS() and setAttributeNS() create namespace-aware nodes, unlike simply adding a colon to an ordinary element name. A node created by one document cannot always be attached directly to another document. importNode() copies it into the receiving document, with a deep option when descendants should come along. adoptNode() has different ownership behavior where supported, so choose intentionally. Test a feed that changes its prefix but retains the same URI. That catches code that accidentally depends on presentation rather than expanded element names.

Some DOM node collections are live: removing one node changes the collection while you iterate. A forward index loop can then skip the node that moved into the removed position. For a known live collection, iterate backward or copy the target nodes into a stable list before removal. Query results and APIs differ in their collection behavior, so do not assume every list is identical. When updating a value, decide whether you want to replace all content or only one text node. Setting textContent removes descendants, which is appropriate for a simple leaf field but destructive for rich structured content. Validate the resulting document before saving if your consumer expects a particular structure. FormatOutput improves readability but is not a guarantee of preserving original whitespace.

DOM holds a document tree, so memory grows with input size and node count. Limit accepted bytes and avoid disabling parser safety limits merely to accommodate an unbounded feed. Untrusted documents should not enable unnecessary DTD loading or entity expansion. If your contract forbids DOCTYPE, reject it; do not turn on LIBXML_NOENT to satisfy a document you never intended to support. LIBXML_NONET is useful but does not replace a complete input policy. DOM is suitable for bounded configuration documents and editing jobs; a streaming parser is a better fit for very large independent records. Serialization can change quote styles, entity spelling, whitespace, or declaration details. If exact original bytes are required for signatures, preserve them and follow the signature format's canonicalization rules.

Load a bounded inventory XML string and remove every product whose discontinued attribute is 'yes'. Collect matching nodes into a stable array before removing them, then serialize the result. The solution checks loadXML(), applies the application's no-DTD policy, and handles a document with no matching nodes. Test two adjacent discontinued products to catch a skipped-node bug. Add a new product using createTextNode() for its name and importNode() if its subtree came from another document. Validate required stock values before saving. Report an invalid document separately from a valid document with no products, because those outcomes have different meanings.

Review file handling for saving snapshots and exceptions for cleanup after parsing failures.

The DOMDocument loadXML reference documents parsing results and options.