
GitHub Actions workflow sandbox for CVE-2025-46820 reproduction
Built on top of PHP's native DOMDocument, this project provides access to modern DOM APIs, as you would expect working with client-side code in the browser.
Performing DOM manipulation in your server-side code enhances the way dynamic pages can be built. Utilising a standardised object-oriented interface means the page can be ready-processed, benefiting browsers, webservers and content delivery networks.
Important note: the example shown here is for illustrative purposes, but using the DOM to directly set data to elements' values tightly couples the logic to the view, which is considered bad practice. Please see the DomTemplate library for a more robust solution to binding data to the DOM.
Consider a page with a form, with an input element to enter your name. When the form is submitted, the page should greet you by your name.
This is a simple example of how source HTML files can be treated as templates. This can easily be applied to more advanced template pages to provide dynamic content, without requiring non-standard techniques such as {{curly braces}} for placeholders, or echo '<div class='easy-mistake'>' . $content['opa'] . '</div>' error-prone HTML construction from within PHP.
name.html)<!doctype html>
<h1>
Hello, <span class="name-output">you</span> !
</h1>
<form>
<input name="name" placeholder="Your name, please" required />
<button>Submit</button>
</form>
index.php)<?php
use Gt\Dom\HTMLDocument;
use Gt\Dom\HTMLElement\HTMLSpanElement;
require "vendor/autoload.php";
$html = file_get_contents("name.html");
$document = new HTMLDocument($html);
if(isset($_GET["name"])) {
$span = $document->querySelector(".name-output");
$span->innerText = $_GET["name"];
}
echo $document;
Element type represents all HTMLElement specifications, such as HTMLAnchorElement (<a>), HTMLButtonElement (<button>), HTMLInputElement (<input>), HTMLTableSectionElement (<thead>, <tbody>, <tfoot>), etc. The particular type can be detected with Element::getElementType(), which returns one of the ElementType enum values.DOMException extensions for catching different types of exception, such as EnumeratedValueException, HierarchyRequestError, IndexSizeException, etc.FileList, StyleSheet, VideoTrackList, WindowProxy, etc.Element::querySelector() and (Element::querySelectorAll())ClassListElement::previousElementSibling, Element::nextElementSibling, Element::children and Element::lastElementChild and firstElementChild, etc.HTMLDocument:
This repository aims to be as accurate as possible to the DOM specification at https://dom.spec.whatwg.org/ - as of v4.0.0 all functionality is implemented with the following minor but unavoidable deviations from the standard:
tagName property is uppercase.HTMLElement type, Element::getElementType() must be called - no subclasses of Element are available for usage with instanceof, for example.HTMLInputElement::files returns a FileList that enumerates all files that are selected by the user through the browser's interface. This kind of functionality is impossible to implement server-side, but has been stubbed out for consistency with the specification. Attempting to use client-side functionality within this library throws a ClientSideOnlyFunctionalityException.This repository is intended to be as accurate to the DOM specification as possible. An extension to the repository is available at https://php.gt/domtemplate which adds page templating and data binding through custom elements and template attributes, introducing serverside functionality like that of WebComponents.
Since PHP 8.4's release, there has been a new native HTMLDocument class shipped in PHP natively. With this having native bindings, all operations are much faster. Work has been started to make PHPGT's Dom implementation utilise the new native code. Luckily, the DOM is a very well defined standard so whatever happens, minimal or no changes will be required to your code.
Take a look at the benchmarks on the php84-benchmark branch for yourself: most operations are recorded to have a 90% or higher increase in speed by switching to the native implementation!
More information will be laid out in the readme when more work has been taken towards an implementation of the native classes.
ChildNode::remove()