Skip to content
PHP 8.1+ Open source Developer documentation
Tools Packagist
Docs v2.0.6
Documentation versions v2.0.6Current v2.0.5Maintenance v2.0.4Maintenance v2.0.3Maintenance v2.0.0Initial v2 Compare versions →
MNB PHPExcelDeveloper Guide
AI

XLSX library

XLSX Inspection and Security

Inspect file and sheet information without loading rows, then validate encryption, uploads, and package integrity.

Level
Intermediate
Reading time
9 min
Package
mnb/mnb-phpexcel-xlsx
Updated
ReadSession::inspect()ReadSession::sheetNames()ReadSession::countRows()Xlsx::isEncrypted()XlsxIntegrityValidator::assertValid()

Inspect workbook metadata without row arrays#

PHP
$session = Xlsx::read('orders.xlsx');
$inspection = $session->inspect();
$sheetNames = $session->sheetNames();

$orders = null;
foreach ($inspection['sheets'] as $sheet) {
    if ($sheet['name'] === 'Orders') {
        $orders = $sheet;
        break;
    }
}

$filledRows = $session
    ->sheet('Orders')
    ->withHeaderRow()
    ->countRows(['skip_empty_rows' => true]);

inspect() reads package structure, workbook relationships, worksheet dimensions, visibility, warnings, and security signals without materializing row arrays. countRows() then streams normalized rows for the selected worksheet when an application needs a populated-record count.

Choose a row-count meaning#

ModeMeaningCost
declared_last_rowLast row from the worksheet dimension stored in inspection metadata.Fastest; relies on producer metadata.
row_tag_countPhysical <row> elements found in worksheet XML.Fast package inspection.
countRows()Rows yielded by the normal reader after header, empty-row, range, and projection options.Streams cell data; does not build a complete row array.

Detect and handle encryption#

PHP
if (Xlsx::isEncrypted('finance.xlsx')) {
    printf("Mode: %s\n", Xlsx::encryptionMode('finance.xlsx') ?? 'unknown');
}

$rows = Xlsx::read('finance.xlsx', [
    'password' => getenv('XLSX_PASSWORD'),
])->sheet('Summary')->rows();

Validate untrusted workbooks before processing#

  • Apply file-size, ZIP-entry, compression-ratio, path, macro, external-link, and encryption policies.
  • Keep uploaded files outside the public root and use application-generated filenames.
  • Limit formulas, source rows, columns, shared strings, and processing time before large imports.
  • Run (new XlsxIntegrityValidator())->assertValid($path) after generating critical reports.

Keep these parser-level controls together with your application upload limits, private storage policy, malware scanning, and authorization checks.