Create and Extract ZIP Archives in PHP

Last updated: August 28, 2026.

ZipArchive can package reports or unpack approved imports. Before extraction, inspect every entry because a malicious archive may try to write outside the destination.

Create an archive

<?php
$zip = new ZipArchive();
if ($zip->open(__DIR__ . '/reports.zip', ZipArchive::CREATE | ZipArchive::OVERWRITE) !== true) throw new RuntimeException('Cannot create archive.');
$zip->addFile(__DIR__ . '/sales.csv', 'sales.csv');
$zip->addFromString('README.txt', "Generated report archive\n");
$zip->close();

Extract safely

• Reject absolute entry paths and parent-directory segments.
• Limit archive size and entry count.
• Extract only into a dedicated directory.
• Validate extracted file types before using them.

Reference: PHP ZipArchive reference.