MNB PHPExcelDeveloper Guide
v2.0.5
Production guide

Spreadsheet Security Checklist

Harden uploads, package parsing, formulas, links, temporary files, encryption, and public error responses.

Updated

LevelAdvancedReading time12 minPackageCore + format module
validateUpload()validateXlsx()cellSafety()encryptXlsx()safeError()

What you will learn

  • Apply layered validation before parsing untrusted workbooks.
  • Separate confidentiality from editing protection.
  • Keep temporary data and error output safe.

Validate before reading#

PHP
$upload = MnbExcel::validateUpload($_FILES['spreadsheet'], [
    'allowed_extensions' => ['xlsx', 'xls', 'ods', 'csv', 'tsv'],
    'max_size_mb' => 100,
    'validate_package' => true,
    'max_zip_entries' => 5000,
    'max_uncompressed_size_mb' => 500,
]);

if (($upload['valid'] ?? false) !== true) {
    throw new RuntimeException('Upload validation failed.');
}

Apply formula and text safety policies#

PHP
$workbook
    ->escapeFormulaLikeText()
    ->maxCellTextLength(32767, 'truncate')
    ->controlCharPolicy('remove')
    ->formulaPolicy('deny-untrusted');

Use encryption for confidentiality#

Workbook or worksheet protection is an editing control, not encryption. Use Agile password-to-open encryption when the workbook contents must remain confidential outside the application.

Review the full deployment checklist#

  • Store uploads and exports outside the public web root.
  • Generate safe filenames and never concatenate user paths.
  • Restrict external hyperlink protocols.
  • Set file-size, package-entry, XML-depth, worksheet, row, cell, and shared-string limits.
  • Do not log workbook passwords, SMTP credentials, or database credentials.
  • Delete temporary decrypted and generated files.
  • Return safe errors; keep stack traces server-side.
  • Run large or untrusted work in a separate process with time and memory limits.