Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Data extraction in PHP starts with identifying the input format and the amount of data you must process. Use XMLReader for forward-only, streaming XML; DOMDocument when you need a navigable tree; an HTML parser that matches your PHP version when processing web markup; explicit validation for request data; and PDO parameter markers for database values. Parsing, validation, output escaping and persistence are separate operations, so no single function safely handles all of them.
Choose the extractor from the input and workload
| Input or task | Suitable starting point | Important boundary |
|---|---|---|
| XML that fits comfortably in memory and needs tree navigation | DOMDocument |
Check the boolean returned by load(); malformed or inaccessible input must be handled. |
| Very large XML or sequential records | XMLReader |
It is a forward-only pull parser, so design the loop around the current node rather than random access. |
| HTML fragments or pages | An HTML parser appropriate to the installed PHP version | Legacy loadHTML()/loadHTMLFile() use libxml2’s HTML parser with HTML 4.01-era behavior; verify the HTML5-capable API available in your runtime. |
| HTTP request fields | filter_input() plus a field-specific rule |
FILTER_DEFAULT is an alias for FILTER_UNSAFE_RAW; retrieving a value is not validation. |
| Rows returned from a database | PDO fetch methods | Keep extracted values in parameter markers instead of concatenating them into SQL. |
Extract XML with DOMDocument
DOM builds a document tree, which is convenient when you need to inspect parents, children and attributes in more than one direction. DOMDocument::load() reads an XML file and returns a success boolean. Always test that result before querying the tree.
Read repeated elements from a file
<?php
$dom = new DOMDocument();
$dom->preserveWhiteSpace = false;
if (!$dom->load(__DIR__ . '/catalog.xml')) {
throw new RuntimeException('The XML file could not be loaded');
}
foreach ($dom->getElementsByTagName('product') as $product) {
$id = $product->getAttribute('id');
$nameNodes = $product->getElementsByTagName('name');
$name = $nameNodes->length ? trim($nameNodes->item(0)->textContent) : null;
if ($name !== null) {
printf("%s: %s%s", $id, $name, PHP_EOL);
}
}
This code treats a missing name as absent instead of silently reading an unrelated node. For namespaces, use DOMXPath and register each namespace URI before querying; matching by a bare tag name can miss namespaced elements.
Handle bad input explicitly
- Distinguish a missing path, unreadable permissions and malformed XML in your application error or log.
- Set an appropriate encoding strategy. XMLReader and libxml represent retrieved content internally as UTF-8.
- Do not assume text content is safe for HTML, JavaScript or SQL merely because it came from XML; encode it for its eventual destination.
Stream large XML with XMLReader
XMLReader advances a cursor through nodes. It is useful when you need each record once and do not want a complete document tree in memory.
#1 Best Overall
Read one record at a time
<?php
$reader = new XMLReader();
if (!$reader->open(__DIR__ . '/large-catalog.xml')) {
throw new RuntimeException('Unable to open XML input');
}
try {
while ($reader->read()) {
if ($reader->nodeType !== XMLReader::ELEMENT || $reader->localName !== 'product') {
continue;
}
$id = $reader->getAttribute('id');
$fragment = $reader->readOuterXML();
if ($fragment === '') {
continue;
}
$record = new DOMDocument();
if (!$record->loadXML($fragment)) {
continue; // log and count malformed records in production
}
$nameNodes = $record->getElementsByTagName('name');
$name = $nameNodes->length ? trim($nameNodes->item(0)->textContent) : null;
processProduct($id, $name);
}
} finally {
$reader->close();
}
function processProduct(?string $id, ?string $name): void
{
// Persist or emit the record here; do not accumulate the entire feed.
}
The outer loop is sequential: once the cursor moves past a node, revisit it only by reopening the source. If records are deeply nested, test the exact element name and namespace rules used by your feed. Keep per-record work bounded so a single unusually large fragment does not defeat the streaming design.
Extract HTML without assuming modern HTML5 behavior
PHP’s legacy DOMDocument::loadHTML() and loadHTMLFile() call libxml2’s HTML parser. The PHP Internals RFC describing the newer HTML5 work documents that the legacy parser follows HTML 4.01-era rules, which can differ from browser parsing. Confirm the installed PHP version and the HTML5-capable class/API before selecting a parser for production.
Legacy DOM example, with controlled expectations
<?php
libxml_use_internal_errors(true);
$dom = new DOMDocument();
if (!$dom->loadHTMLFile('https://example.test/news')) {
libxml_clear_errors();
throw new RuntimeException('HTML could not be parsed');
}
foreach ($dom->getElementsByTagName('a') as $link) {
$href = $link->getAttribute('href');
$label = trim($link->textContent);
if ($href !== '') {
printf("%s => %s%s", $label, $href, PHP_EOL);
}
}
libxml_clear_errors();
For untrusted HTML, parsing is not sanitizing. If extracted markup will be displayed, apply an HTML sanitizer appropriate to your threat model. Resolve relative URLs against a known base rather than treating an href as an absolute address, and set network timeouts in the HTTP layer that obtains the page.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Validate request data before using it
filter_input() reads the original value supplied by the SAPI. Its default, FILTER_DEFAULT, performs no filtering. Select a rule that matches the field’s expected format, then check the result and separately escape it for HTML, a URL, a shell argument or another destination.
Rank #2
Typed query parameters
<?php
$page = filter_input(INPUT_GET, 'page', FILTER_VALIDATE_INT, [
'options' => ['min_range' => 1, 'max_range' => 1000],
]);
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
if ($page === false || $page === null || $email === false || $email === null) {
http_response_code(400);
exit('Invalid input');
}
// Use htmlspecialchars($email, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')
// when placing the value in an HTML response.
A value can be syntactically valid yet unacceptable to your business rule. Apply allow-lists, length limits and authorization checks after type validation. Do not use one global filter for every field.
Extract and store database results with PDO
For database input, fetch rows with PDO and keep SQL values in placeholders. Named and question-mark markers are both supported, but use one marker style per statement. Driver behavior matters: PDO_MYSQL documents emulated prepares as enabled by default, so confirm and configure the driver behavior required by your deployment.
Parameterized extraction and insertion
<?php
$pdo = new PDO($dsn, $username, $password, [
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);
$select = $pdo->prepare(
'SELECT id, title, published_at FROM articles WHERE author_id = :author ORDER BY published_at DESC'
);
$select->execute(['author' => $authorId]);
while ($row = $select->fetch(PDO::FETCH_ASSOC)) {
$title = $row['title'];
// Validate and encode $title at the output boundary.
}
$insert = $pdo->prepare(
'INSERT INTO extracted_values (source_id, value_text) VALUES (:source, :value)'
);
$insert->execute(['source' => $sourceId, 'value' => $value]);
Placeholders represent values, not table names, column names or arbitrary SQL fragments. If a sort column must be selectable, map a small allow-list of application names to fixed SQL identifiers rather than binding the identifier.
Free tools Windows power users keep installed
One-click scans. No signup required.
JSON and CSV: keep the boundary explicit
JSON and CSV are common extraction inputs, but exact function signatures, options and version behavior should be checked against the current PHP manual for your runtime before shipping. Regardless of format, separate decoding from schema validation: verify required fields, types, limits and character encoding before persistence. For large files, process records incrementally where the format and parser you select support it; do not assume a whole-file decode is appropriate.
Extraction pipeline: parse, validate, normalize, persist
- Acquire: enforce source allow-lists, authentication and network/file limits.
- Parse: choose DOM, XMLReader or the version-appropriate HTML/JSON/CSV parser.
- Validate: check required fields, types, ranges, lengths, namespaces and business rules.
- Normalize: convert dates, whitespace, identifiers and encodings to your internal representation.
- Persist or emit: use PDO parameters, transactions and bounded batches.
- Observe: count rejected records, parser errors, duration and source identifiers without logging secrets.
Performance, reliability and security checklist
- Use XMLReader for sequential feeds and release per-record objects promptly.
- Set network timeouts and maximum response sizes before parsing remote content.
- Expect malformed records, missing fields, duplicate identifiers and unexpected namespaces.
- Keep parser errors separate from validation errors so operators can find the failing stage.
- Escape output for its context; input filtering is not output encoding.
- Use least-privilege database credentials and parameter markers for every external value.
- Test with empty documents, invalid encodings, very long fields, hostile HTML and truncated downloads.
Common failures and fixes
“load() returned false”
Check the path, permissions and XML well-formedness. Capture libxml diagnostics in a controlled logging path and return a useful application error instead of continuing with an empty tree.
HTML nodes differ from a browser
You may be using the legacy libxml2 HTML parser against HTML5 markup. Verify your PHP version and select the HTML5-capable API available there, or adjust the source and parser combination deliberately.
filter_input accepted dangerous text
This is expected when the default filter was used. Apply a type-specific validation rule, then context-appropriate output encoding.
SQL values break a query
Stop concatenating extracted strings into SQL. Prepare the statement, bind or execute with parameters, and check driver prepare settings—especially PDO_MYSQL emulation.
Rank #4
Streaming code still uses too much memory
Inspect per-record fragments, accumulated arrays, logs and database buffers. XMLReader only controls document traversal; your own processing can still retain every record.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Or skip the browser setup
If your extraction starts with a rendered web page rather than an XML endpoint, ScreenshotNeo provides a website screenshot API and MCP server. A single request can return PNG, JPEG, WebP or PDF. Before capture it accepts the cookie/consent banner like a visitor and removes more than 60 known consent platforms, newsletter popups and chat widgets; each step can be turned off. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads and cache hits are not billed, and response headers report the page verdict and billing status.
Use the API directly (the complete option set includes full-page and selector capture, device and retina settings, waits, custom CSS/JavaScript, headers and cookies, blocking rules, geolocation, PDF controls, caching, signed links, asynchronous webhooks, bulk capture and a usage API):
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for parameters and response headers. The same request from PHP is:
<?php
$r = file_get_contents('https://api.screenshotneo.com/v1/shot?' . http_build_query([
'access_key' => 'YOUR_API_KEY',
'url' => 'https://stripe.com',
]));
file_put_contents('shot.webp', $r);
Python and Node.js equivalents:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);An MCP server lets Claude, Cursor and other MCP clients call take_screenshot, get_page_info and capture_pdf. The Free plan includes 1,000 shots per month with no card; paid plans start at $5 for 3,000 shots. Sign up for the free ScreenshotNeo plan.
Frequently Asked Questions
Should I always use DOMDocument for XML?
No. Use DOMDocument for tree navigation and XMLReader when forward-only traversal of a large or sequential feed is the better fit.
Does filter_input sanitize user input?
Not by default. FILTER_DEFAULT is FILTER_UNSAFE_RAW; choose validation rules for the expected field and encode output for its destination.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Can PDO placeholders represent a table name?
No. Placeholders are for values. Map permitted identifiers to fixed SQL text and parameterize the values.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
