Description of the problem of using zip_read() to invalidate encrypted Zip files

M66 2025-06-05

In PHP, when operating Zip files, we often use the zip_read() function, which belongs to part of the ZipArchive class and is mainly used to traverse and read file entries in the Zip package. However, when encountering an encrypted Zip file, many developers find that reading with zip_read() fails or simply cannot access the encrypted content. So why is this? This article will combine PHP's Zip extension mechanism to analyze the causes of this problem and its solutions in detail.

1. Problem phenomenon

 $zip = zip_open('encrypted.zip');
if ($zip) {
    while ($entry = zip_read($zip)) {
        echo zip_entry_name($entry) . "\n";
        if (zip_entry_open($zip, $entry)) {
            echo zip_entry_read($entry, zip_entry_filesize($entry));
            zip_entry_close($entry);
        }
    }
    zip_close($zip);
}

The above code works normally when reading a normal Zip file, but when encountering an encrypted Zip file, the following problems often occur:

Unable to read the file contents, zip_entry_read() returns an empty string or an error.
It cannot even traverse to any file entries, which manifests as zip_read() returns false .

2. Root Cause Analysis

zip_read() belongs to the old interface of PHP's libzip library (low-level operations based on ZIP files), and does not natively support decryption of encrypted file contents. Encrypted Zip files (usually password-protected) use the method of encrypting file data, and the data is not simply stored in plain text.

zip_read() can only access file entries and unencrypted file contents in Zip files.
If the Zip file is encrypted, the Zip extension must call the corresponding decryption logic to correctly read the file by providing the correct password.
PHP's zip_read() does not provide password parameters and does not support automatic decryption.

In short, zip_read() does not support the reading of encrypted files in design.

3. Correct way: Use the password decryption function of ZipArchive class

The Zip extension from PHP, which starts with version 7.2, provides a more complete ZipArchive class, which supports setting passwords to read encrypted files:

 $zip = new ZipArchive();
$res = $zip->open('encrypted.zip');
if ($res === true) {
    // Set password
    $zip->setPassword('your_password');
    for ($i = 0; $i < $zip->numFiles; $i++) {
        $stat = $zip->statIndex($i);
        echo "File: " . $stat['name'] . "\n";

        $stream = $zip->getStream($stat['name']);
        if (!$stream) {
            echo "Failed to open stream for {$stat['name']}\n";
            continue;
        }

        $contents = stream_get_contents($stream);
        fclose($stream);
        echo $contents;
    }
    $zip->close();
} else {
    echo "Failed to open zip file\n";
}

Key notes:

The setPassword() method is used to provide the password required for decryption.
Use getStream() to get the content stream of the encrypted file, provided that the password is correct.
This method can read the encrypted Zip file contents normally.

4. Summary

zip_read() is a Zip operation interface in PHP in the early days and cannot process encrypted files.
Encrypted Zip files must use interfaces that support password decryption, such as ZipArchive.
With ZipArchive::setPassword() , PHP can successfully open and read encrypted files.
In actual development, it is recommended to use the ZipArchive class when encountering encrypted Zip files to avoid using outdated zip_read() .

zip_read