获取PHP中上传的XML文件的完整内容

Question

I'm building a file upload form where users can submit XML configuration files. My goal is to get the full contents and insert them into Wordpress as a new post (custom post type). It's working for the most part, except I am having difficulty pulling the XML tags with the content when using file_get_contents() . Does this omit XML tags when used? If so, how can I get the full contents of the file?

Here is my code for the form and handler...

function slicer_profile_form()
{
    echo '<form action="' . esc_url( $_SERVER['REQUEST_URI'] ) . '" method="post" enctype="multipart/form-data">';

    echo '<p>';
    echo 'Profile<br />';
    echo '<input type="file" name="slicer-profile" accept="text/xml">';
    echo '</p>';

    echo '<p><input type="submit" name="slicer-profile-submitted" value="Submit"/></p>';
    echo '</form>';
}

function slicer_profile_submit()
{
    // if the submit button is clicked, submit
    if (isset($_POST['slicer-profile-submitted']))
    {
        $contents = file_get_contents( $_FILES['slicer-profile']['tmp_name'] );
        var_dump($contents);
    }
}

Answer 1

You can use this.

 <?php
$xml=simplexml_load_file($_FILES['slicer-profile']['tmp_name']) or die("Error: Cannot create object");
print_r($xml);
?> 

It will give the xml content.

Answer 2

Your script is potentionally unsecure, you would possibly need to go through a proper file upload process using php commands like: is_uploaded_file and move_uploaded_file

I always check for blacklisted file types aswell as checking the type of file I am receiving. You will also need to make sure the contents of what you are receiving are also safe.

By changing to:

echo '<pre>';
var_dump($contents);
echo '</pre>';

Your current script might output correctly.