Wechat Open platform-the way in which PHP decrypts Wechat's push messages developed by a third-party platform

when docking Wechat"s open platform
to decrypt Wechat"s push message
used the official decryption file and method
php code as shown in figure

msgTicket

What

does not understand is that the object obtained by
using simplexml_load_string is also empty, which I can understand, because msg is an empty string
but why can I get this ticket after using DOMDocument loadXML?
the decrypted msg is obviously empty

Why is there such a big difference between using simplexml_load_string and DOMDocment

Please give us some advice

Mar.07,2021

this is my solution. You can refer to the following:

//ComponentVerifyTicket
$encodingAesKey = '';    //"Key"
$token = '';  //"Token"
$appId = '';  //"Token"
$msg_signature = $request['msg_signature'];
$timestamp = $request['timestamp'];
$nonce = $request['nonce'];
$encryptMsg = file_get_contents('php://input');

libxml_disable_entity_loader(true);
$xml_obj = (array)simplexml_load_string($encryptMsg, 'SimpleXMLElement', LIBXML_NOCDATA);

// xml
$encrypt = $xml_obj['Encrypt'];
$encryptMsg = sprintf("<xml><ToUserName><![CDATA[toUser]]></ToUserName><Encrypt><![CDATA[%s]]></Encrypt></xml>", $encrypt);

// 
$pc = new WXBizMsgCrypt($token, $encodingAesKey, $appId);
$pc->WXBizMsgCrypt($token, $encodingAesKey, $appId);
$msg = '';
$errCode = $pc->decryptMsg($msg_signature, $timestamp, $nonce, $encryptMsg, $msg);
if ($errCode) {
    return $errCode;
}
else {
    libxml_disable_entity_loader(true);
    $xml_obj = (array)simplexml_load_string($msg, 'SimpleXMLElement', LIBXML_NOCDATA);
    // ComponentVerifyTicket
    return $xml_obj['ComponentVerifyTicket'];
}
Menu