PHP动态生成用户XML并实现跨域调用技术问题求助

Alright, let's work through this problem step by step. Ditching static XML files for dynamic generation via PHP was a smart call—static files can't retroactively cover existing users, so dynamic is the way to go. Here's how to get this up and running properly, including fixing those cross-domain hurdles:

First, create a core script (let's call it user-xml.php) that handles fetching user data from your database and outputting valid XML, while also addressing cross-domain access upfront.

<?php
// Enable debugging (remove in production)
error_reporting(E_ALL);
ini_set('display_errors', 1);

// 1. Handle cross-domain permissions first
// Allow all domains for testing; restrict to your target domain in production
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: GET");
header("Access-Control-Allow-Headers: Content-Type");

// 2. Get and validate the user ID from the request
$userId = isset($_GET['user_id']) ? intval($_GET['user_id']) : 0;

if ($userId === 0) {
    header("HTTP/1.1 400 Bad Request");
    echo '<error>Missing or invalid user ID</error>';
    exit;
}

// 3. Fetch user data from your database (replace with your DB credentials)
$db = new PDO('mysql:host=your-db-host;dbname=your-db-name', 'db-username', 'db-password');
$stmt = $db->prepare("SELECT id, name, email, username FROM users WHERE id = ?");
$stmt->execute([$userId]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if (!$user) {
    header("HTTP/1.1 404 Not Found");
    echo '<error>User not found</error>';
    exit;
}

// 4. Set the correct content type for XML
header("Content-Type: application/xml; charset=utf-8");

// 5. Generate and output valid XML (use htmlspecialchars to avoid injection issues)
echo '<?xml version="1.0" encoding="UTF-8"?>';
echo '<user>';
echo '<id>' . htmlspecialchars($user['id']) . '</id>';
echo '<name>' . htmlspecialchars($user['name']) . '</name>';
echo '<email>' . htmlspecialchars($user['email']) . '</email>';
echo '<username>' . htmlspecialchars($user['username']) . '</username>';
// Add any other user fields you need here
echo '</user>';
?>

Key notes here:

• We set CORS headers first to allow cross-domain requests
• We validate and sanitize the user ID to prevent SQL injection (using PDO prepared statements is critical here)
• htmlspecialchars ensures user data doesn't break the XML structure

To get that clean /user/22/xml URL structure, you'll need to use URL rewriting. If you're using Apache, create an .htaccess file in your root directory with these rules:

RewriteEngine On
# Rewrite /user/{numeric-id}/xml to our PHP script with the user ID as a parameter
RewriteRule ^user/([0-9]+)/xml$ user-xml.php?user_id=$1 [L]

For Nginx, add this to your server block instead:

location ~ ^/user/([0-9]+)/xml$ {
    rewrite ^/user/([0-9]+)/xml$ /user-xml.php?user_id=$1 last;
}

Now visiting www.example.com/user/22/xml will route directly to your PHP script with the correct user ID.

From your context, it looks like cross-domain access is the main roadblock. Here's how to refine that:

• Restrict access in production: Replace header("Access-Control-Allow-Origin: *"); with the specific domain that needs to pull the XML, e.g.:

  header("Access-Control-Allow-Origin: https://your-other-domain.com");
  

• Check browser console: If you still get CORS errors, open your browser's dev tools > Network tab, inspect the request, and look for specific CORS-related error messages (this will tell you if the headers are being set correctly).
• Legacy browser fallback: If you need to support super old browsers (IE8/9) that don't handle CORS, have the calling domain use a server-side proxy (their backend fetches the XML from your server, then serves it to their frontend—no cross-domain issues that way).

1. Test the XML output directly: Visit www.example.com/user/22/xml in your browser to confirm it returns valid XML without errors.
2. Verify database connectivity: Ensure your PHP script can connect to the database and fetch user data correctly.
3. Check rewrite rules: Make sure mod_rewrite is enabled on Apache (or Nginx rewrite rules are applied) so the friendly URLs work.

内容的提问来源于stack exchange，提问作者Vince Begin