An XLSX download is a ZIP-based binary file. If PHP prints a warning, deprecation message, byte-order mark, or whitespace into the response, Excel receives invalid leading bytes. Fix the warning and make the download endpoint emit only workbook data.
Last updated: November 4, 2026.
<?php
use PhpOfficePhpSpreadsheetIOFactory;
ini_set('display_errors', '0');
ini_set('log_errors', '1');
$writer = IOFactory::createWriter($spreadsheet, 'Xlsx');
while (ob_get_level() > 0) {
ob_end_clean();
}
header('Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
header('Content-Disposition: attachment; filename="report.xlsx"');
header('Cache-Control: max-age=0');
$writer->save('php://output');
exit;This protects the binary response from buffered output. It does not repair incompatible library code; review the PHP error log and correct every reported warning.
Upgrade before suppressing anything
Run composer show phpoffice/phpspreadsheet and compare the installed version with the project’s supported PHP versions. Update PhpSpreadsheet and its dependencies in a test environment, then run the export under the same PHP version used by the web server.
PHP’s error-handling configuration documentation explains display_errors and log_errors. Disable display in production while logging problems outside the response. Do not solve a deprecation by globally changing error_reporting until it disappears; that hides the compatibility work still required.
Verify the response at the byte level
The official PhpSpreadsheet browser-output recipe warns that echo statements, whitespace, or a UTF-8 BOM can corrupt the file. Keep the endpoint free of templates, debugging output, and closing PHP tags in included files.
PHP output buffers can be nested, so clear all removable active buffers before sending headers. The output-buffer documentation explains that most ob_* functions operate on the active buffer only.
Download the response with browser developer tools or curl. An XLSX normally begins with the ZIP signature PK; readable warning text before it proves response contamination. Also confirm the HTTP status and content type. Continue with creating spreadsheet files with PHP, handling PHP 8.5 deprecations, and processing large tabular files.
