Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not so much looking for code (although if you want to link to tutorials it would be appreciated) as I am trying to get an idea of what people in the know are doing. Our system is written in PHP.

As part of an Electronic Medical Record System, I need to be able to securely exchange documents (Word, PDF, etc.) with business partners. I also need to transmit identifying information with the documents (patient name, medical record number, etc.)

If I Google exchanging files in a web service, I am given a bunch of information about a variety of methods. But, what's not easy to see is how old the information is, how commonly the methods are used, and if there is something out there that if I just knew what I was looking for, would blow my socks off.

TLDR - If you were going to use a web service to exchange files, and your system was written in PHP, how would you go about doing it, and why?

share|improve this question

Use https and REST. Its secure, tested, and works on any platform. We have two formats that uses a file extension of either .xml or .json for easy consumption, when performing either a POST or GET request. we have http headers that identify if POST is actual a PUT, POST, or DELETE request since not all clients/servers/firewalls allow/recognize PUT and/or DELETE.

One gotcha with using REST is defining an API. The natural tendency is to use a uri style that mimics the familar RPC style. You need to work backwards, and define your uri with the object(s) being acted upon first, and use the verbs (GET,PUT,POST,DELETE) for your operations.

SOAP in comparison has more features, but about 95%(a measure I pulled out of the air) of the features are never used. It complicates understanding it, and adds overhead to development. I would only recommend using it if REST did not provide you with everything you need.

share|improve this answer
That parts a given :) But, I'm trying to write an API and am looking for the current technology that would best suit this project - Rest? Soap? Something else? – Amy Anuszewski Aug 25 '11 at 20:14
updated my answer – Charles Lambert Aug 26 '11 at 0:03
Please make an attempt to support this answer with facts, experiences, and/or references. I very rarely see REST used to exchange binary files, much less binary files with metadata. – Aaronaught Aug 26 '11 at 0:05
@Aeronaught - everytime you download a file directly via a url (e.g. you are exchanging a file via REST – Charles Lambert Aug 26 '11 at 0:56
@Aaronaught - She specifically asked how would I do it and why. My first edition of my answer had all of that information. Under your advice, which I agreed with, I added more information. I also commented on a common example of transferring binary files since you said you had not seen it done much. – Charles Lambert Aug 26 '11 at 1:56

Although you can secure any service, SOAP is really the only specification which actually has a standardized, configurable, built-in security model, that being WS-Security. Services secured this way will not be as easy to work with as REST services, but the support is there for all major platforms including .NET, Java, and C++. PHP support is also available through Apache Rampart/C.

As far as attachments go, you have two options: The first, and preferred option, is MTOM. Some Google hunting brings up a few libraries/frameworks for PHP that apparently support it, but I can't speak from direct experience. The other option, if you can't get MTOM to work, is old-school Base64 encoding. It's crude, but it does the job.

Obviously, WS-Security works over SSL if you want it to, although SSL is actually unnecessary because the specification provides for message-level encryption. Most people who use SSL for SOAP services do it simply because it's easier to configure and administer than (for example) mutual certificate authorization, which usually requires a PKI.

The disadvantage of SOAP and WS-Security is that it's very difficult to use in languages/platforms that don't have built-in support for it (e.g. JavaScript). Obviously you have to know who your clients are going to be.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.