In PHP, ZipArchive::extractTo() helps with ZIP archives. Extracts selected ZIP members to a filesystem directory; safe extraction requires validating entry paths and resource limits.
What Is ZipArchive::extractTo() in PHP?
The function or method has a specific purpose: Extracts selected ZIP members to a filesystem directory; safe extraction requires validating entry paths and resource limits. The following examples show the main call, one additional situation, and an application-style use.
Syntax:
<?php
ZipArchive::extractTo(string $pathto, array|string|null $files = null): bool
Parameters and Return Value
$pathto— directory that receives extracted entries.$files— optional list of archive members to extract.
Example 1: Basic Usage
Extracts selected ZIP members to a filesystem directory; safe extraction requires validating entry paths and resource limits.
<?php
$archivePath = sys_get_temp_dir() . "/example-guide.zip";
$archive = new ZipArchive();
if ($archive->open($archivePath, ZipArchive::CREATE) !== true) { throw new RuntimeException("Cannot open ZIP"); }
$archive->addFromString("notes/readme.txt", "Hello ZIP");
$extractDirectory = sys_get_temp_dir() . "/zip-guide-extracted";
if (!is_dir($extractDirectory)) { mkdir($extractDirectory, 0700, true); }
$result = $archive->extractTo($extractDirectory, ["notes/readme.txt"]);
var_dump($result);
$archive->close();
This example demonstrates the central operation. The final output depends on the supplied input and, where relevant, the runtime or connected service.
Example 2: Handling a Different Case
<?php
$archivePath = sys_get_temp_dir() . "/second-guide.zip";
$archive = new ZipArchive();
if ($archive->open($archivePath, ZipArchive::CREATE) !== true) { throw new RuntimeException("Cannot open ZIP"); }
$archive->addFromString("notes/readme.txt", "Updated ZIP entry");
$extractDirectory = sys_get_temp_dir() . "/zip-guide-extracted";
if (!is_dir($extractDirectory)) { mkdir($extractDirectory, 0700, true); }
$result = $archive->extractTo($extractDirectory, ["notes/readme.txt"]);
var_dump($result);
$archive->close();
The second example focuses on a different input or failure condition, so the behavior can be distinguished from the basic case.
Practical Example
<?php
$archivePath = sys_get_temp_dir() . "/practical-guide.zip";
$archive = new ZipArchive();
if ($archive->open($archivePath, ZipArchive::CREATE) !== true) { throw new RuntimeException("Cannot open ZIP"); }
$archive->addFromString("notes/readme.txt", "Team project files");
$extractDirectory = sys_get_temp_dir() . "/zip-guide-extracted";
if (!is_dir($extractDirectory)) { mkdir($extractDirectory, 0700, true); }
$result = $archive->extractTo($extractDirectory, ["notes/readme.txt"]);
var_dump($result);
$archive->close();
The practical example demonstrates how the same subject fits into a larger application. Use your own file paths, endpoints and validated inputs rather than copying sample settings directly.
Important Behavior and Edge Cases
- Extracts selected ZIP members to a filesystem directory; safe extraction requires validating entry paths and resource limits.
- Check the return value and exceptions for failure before using the result. If an extension or external system is required, the example only works when that dependency is available. ZIP entries and uploaded files must never be treated as trusted merely because their extension looks correct.
- Close the ZIP archive to finalize changes; extraction requires checks against path traversal and oversized expanded content.
Comparison With Related Functions
| Approach | Difference |
|---|---|
| ZipArchive::extractTo | Extracts selected ZIP members to a filesystem directory; safe extraction requires validating entry paths and resource limits. |
| ZipArchive::open | Opens an archive and selects read or write mode before entry operations. |
Common Beginner Mistakes
| Mistake | Correct Approach |
|---|---|
| Forgetting to close an archive | Call close() and check its result so changes are committed. |
| Assuming archive entry names are safe to extract | Check extracted paths, entry counts and expanded file sizes. |
| Treating a ZIP password as automatic encryption | Choose entry encryption explicitly when writing encrypted archives. |
Key Takeaways
- Extracts selected ZIP members to a filesystem directory; safe extraction requires validating entry paths and resource limits.
- Check the return value and exceptions for failure before using the result. If an extension or external system is required, the example only works when that dependency is available. ZIP entries and uploaded files must never be treated as trusted merely because their extension looks correct.
- Close the ZIP archive to finalize changes; extraction requires checks against path traversal and oversized expanded content.
Extracts selected ZIP members to a filesystem directory; safe extraction requires validating entry paths and resource limits. Use this approach when its capabilities and constraints match the application. Handle invalid data, failure conditions and resource cleanup explicitly.