XML Parsing with Expat

The parser announces a start element with its name and attributes, may announce character data one or several times, and announces an end element. Your handlers receive the parser plus event details. A small state machine keeps the current path, current product, and current field. When a product begins, initialize a record. When its quantity begins, reset a text buffer. Append every character-data fragment while that field is active. When quantity ends, validate the complete buffer. When product ends, emit or store the complete record. This design is clearer than trying to infer structure from the most recent callback alone. Nested elements and whitespace can produce events you do not care about, so explicitly define which paths the feed supports.

Never assume one callback contains a complete text value. Chunk boundaries, entities, encoding conversion, and parser internals can split a logical value across several events. Replacing the buffer on each callback loses earlier text; appending preserves it. Trim after the closing element if the field's rules allow surrounding whitespace, rather than trimming every fragment separately and accidentally removing meaningful spaces. A note containing 'blue ' and 'pen' in separate callbacks should remain 'blue pen'. Limit the accumulated field length so a single huge value cannot exhaust memory. Validate once a complete field is available. Event parsing avoids a full document tree, but your handler can still recreate an unbounded memory problem if it collects every record into one giant array.

The XML parser supports case-folding options. Legacy examples may silently uppercase names, which can surprise code written for lowercase feed elements. Set XML_OPTION_CASE_FOLDING explicitly so the handler receives the names your contract expects. Namespaces need their own decision: xml_parser_create_ns() can expose namespace-qualified names separated by a configured separator. Compare expanded names according to the namespace URI rather than relying only on a source prefix. Attribute names and values arrive separately from character data. Do not assume an attribute exists because the XML parses correctly. Required attributes, allowed element ordering, and unexpected nesting are application checks. A parser's grammar knowledge does not automatically enforce your product-feed structure.

Create the parser, register handlers, and call xml_parse() for each chunk. The final argument tells the parser when no more input will arrive. A document missing its closing tag may not be recognized as incomplete until finalization, so a successful intermediate chunk is not proof of a complete valid document. For file streams, read bounded chunks and handle fread() failure distinctly from end of file. Feed the final empty chunk with the final flag if that keeps the loop logic clear. Avoid committing database records merely because their closing tags appeared if your acceptance policy requires the entire document to be valid. Stage records or wrap the import in a transaction under a size-appropriate policy.

xml_parse() indicates success or failure. On failure, xml_get_error_code() and xml_error_string() identify the parser problem, while line and column functions locate it. Include a record or job identifier in the private log. User-facing responses should explain that the document is invalid without dumping confidential XML or infrastructure paths. A callback can also fail because of business rules, such as a negative stock quantity; distinguish that from malformed XML syntax. Use a consistent cleanup boundary around the stream and parser references. In PHP 8, xml_parser_create() returns an XMLParser object, and normal object lifetime manages its memory. Old examples centered on resource types and explicit free calls need version-aware review rather than copying them unchanged.

Bound input bytes, nesting depth, record count, and accumulated text. Reject unsupported DTD or external-entity features under the feed contract and do not install a handler that fetches arbitrary external entities. Validate any URL separately before downloading XML. For a supplier import, stage accepted records and mark the job complete only after final parse success. Decide what to do when a later syntax error follows earlier valid records. A transaction, staging table, or documented partial acceptance policy makes the outcome predictable. A tree parser may be simpler for small documents that need arbitrary navigation. Choose streaming because it supports the data volume and record flow, not merely because the word streaming sounds faster.

Extend the state machine to read product code attributes and quantity elements. Reset the quantity buffer on its start event, append text fragments, and validate a nonnegative integer on its end event. Emit the record only at the product end. The solution must produce the same records when input arrives as one large chunk or many small chunks. Test whitespace around quantity, two consecutive products, a missing code, and a document truncated near the end. Add a maximum field length and nesting depth. Do not collect every emitted record in memory for a large import; stage or process bounded batches under the documented failure policy.

Use functions for callbacks, file handling for chunked reads, and exceptions for import failure boundaries.

The XML parser reference documents the PHP 8 XMLParser return type.