A micro dependency free PHP framework

To built web apps without relying on external PHP dependencies.

Get started Documentation

Lightweight

The framework is lightweight, providing a basic but useful set of features.

MVC

The framework is based on MVC for structured development and scalability.

Extendable

The framework supports easy extension for adding or modifying features as needed.

Secure

Basic type of security features are included. Among other things CSRF and SQL injection protection.

A quick demo

Building a login/register system with a sepperate restricted login route for the type of admin user. 

<?php

use core\http\Route;
use core\http\Middleware;

new Route(['GET' => '/'], ['HomeController' => 'index']);

Middleware::route(['login' => false], function() {

  new Route(['GET' => '/register'], ['RegisterController' => 'showRegisterView']);
  new Route(['POST' => '/users/store'], ['RegisterController' => 'storeUsers']);
  new Route(['GET' => '/login'], ['LoginController' => 'showLoginView']);
  new Route(['POST' => '/auth'], ['LoginController' => 'authUsers']);

  new Route(['GET' => '/admin/login'], ['admin\LoginController' => 'showAdminLoginView']);
  new Route(['POST' => '/admin/auth'], ['admin\LoginController' => 'authAdminUsers']);
});

Middleware::route(['auth' => null], function() {

  new Route(['GET' => '/profile/[username]'], ['ProfileController' => 'showProfileView']);
});

Middleware::route(['auth' => 'admin'], function() {

  new Route(['GET' => '/admin/profile/[username]'], ['admin\ProfileController' => 'showAdminProfileView']);
});

Middleware::route(['login' => true], function() {

  new Route(['GET' => '/logout'], ['LogoutController' => 'unsetSessions']);
}); 
<?php

namespace app\controllers;
                
use app\models\User;
use validation\Rules;
use core\Csrf;
use core\Session;
                
class RegisterController extends Controller {

  private $_data;
                  
  public function showRegisterView() {
  
    $this->_data['rules'] = [];
  
    return $this->view('register')->data($this->_data);
  }
                  
  public function storeUsers($request) {    
                        
    $rules = new Rules();

    if($rules->register($request, User::where(['username' => $request['username']]), User::where(['email' => $request['email']]), Csrf::get())->validated() ) {
                  
      User::insert([
          
        'username' => $request['username'],
        'email' => $request['email'],
        'password' => password_hash($request['password'], PASSWORD_DEFAULT),
        'created_at' => date('Y-m-d H:i:s'),
        'updated_at' => date('Y-m-d H:i:s'),
        'role_id' => User::getRoleId()        
                
      ]);
      
      Session::set('success', 'You have successfully been registered!');
      
      redirect('/login');
      
    } else {
                  
      $this->_data['username'] = $request['username'];
      $this->_data['email'] = $request['email'];                   
      $this->_data['rules'] = $rules->errors;
      
      return $this->view('register')->data($this->_data);
    }     
  }  
}      

<?php

namespace app\controllers;
                
use extensions\Auth;
use validation\Rules;
use core\Csrf;
                
class LoginController extends Controller {

  private $_data;
  
  public function showLoginView() {
    
    $this->_data['rules'] = [];
    $this->_data['username'] = '';
    
    return $this->view('login')->data($this->_data);
  }
                  
  public function authUsers($request) {    
                        
    $rules = new Rules();

    if($rules->login($request, Csrf::get())->validated() && Auth::success(['username' => $request]) ) {
                  
      redirect('/profile/' . $request["username"]);
          
    } else {
                  
      $this->_data['username'] = $request['username'];                  
      $this->_data['rules'] = $rules->errors;
      
      return $this->view('login')->data($this->_data);
    }
  }       
}
<?php

namespace app\controllers\admin;
                
use extensions\Auth;
use validation\Rules;
use core\Csrf;
                
class LoginController extends \app\controllers\Controller {

  private $_data;
  
  public function showAdminLoginView() {
    
    $this->_data['rules'] = [];
    $this->_data['username'] = '';
    
    return $this->view('admin/login')->data($this->_data);
  }
                  
  public function authAdminUsers($request) {    
                        
    $rules = new Rules();

    if($rules->login($request, Csrf::get())->validated() && Auth::success(['username' => $request], ['role' => 'admin']) ) {
                  
      redirect('/admin/profile/' . $request['username']);
          
    } else {
                  
      $this->_data['username'] = $request['username'];                  
      $this->_data['rules'] = $rules->errors;
      
      return $this->view('admin/login')->data($this->_data);
    }
  }       
}
<?php

namespace app\controllers;

use core\Session;
use core\http\Response;
                
class ProfileController extends Controller {
  
  private function check($username) {
  
    if($username !== Session::get('username') ) {
    
      return Response::statusCode(404)->view('/404/404')->data() . exit();
    }
  }
  
  public function showProfileView($request) {
    
    $this->check($request['username']);
    
    return $this->view('profile')->data();
  }      
}
<?php

namespace app\controllers\admin;

use app\models\User;
use core\Session;
use core\http\Response;
                
class ProfileController extends \app\controllers\Controller {
  
  private $_data;
                  
  private function check($username) {
  
    if($username !== Session::get('username') ) {
    
      return Response::statusCode(404)->view('/404/404')->data() . exit();
    }
  }                  
                  
  public function showAdminProfileView($request) {
  
    $this->check($request['username']);  
  
    $this->_data['role'] = User::getRole(Session::get('username'));
    
    return $this->view('admin/profile')->data($this->_data);
  }       
}
<?php

namespace app\controllers;

use core\Session;
                
class LogoutController extends Controller {
                  
  public function unsetSessions() {
  
    Session::delete('logged_in');
    Session::delete('username');
    Session::delete('role');
    
    redirect('/');
  }       
}
<h1>Register form</h1>

<form method="POST" action="/users/store">                
  <div class="container">                
    <label for="username">Username:</label>                
    <input type="text" id="username" name="username" value="<?php if(!empty($username) ) { echo $username; } ?>"/>                
    <span class="validation-messages">                
      <?php echo validation\Errors::get($rules, 'username'); ?>                
    </span>                
  </div>  
  <div class="container">                
    <label for="email">Email:</label>                
    <input type="email" id="email" name="email" value="<?php if(!empty($email) ) { echo $email; } ?>"/>                
    <span class="validation-messages">                
      <?php echo validation\Errors::get($rules, 'email'); ?>                
    </span>                
  </div>   
  <div class="container">                
    <label for="password">Password:</label>                
    <input type="password" id="password" name="password"/>                
    <span class="validation-messages">                
      <?php echo validation\Errors::get($rules, 'password'); ?>                
    </span>                
  </div>   
  <div class="container">                
    <label for="retypePassword">Retype password:</label>                
    <input type="password" id="retypePassword" name="retypePassword"/>                
    <span class="validation-messages">                
      <?php echo validation\Errors::get($rules, 'retypePassword'); ?>                
    </span>                
  </div>   
  <div class="container">
    <input type="hidden" name="token" value="<?php core\Csrf::token(); ?>"/>    
    <input name="submit" type="submit" value="Create account">
  </div>                
</form>                 

<h1>Login form (roleless)</h1>

<?php core\Alert::message('success'); ?>

<form method="POST" action="/auth">                
  <div class="container">                
    <label for="username">Username:</label>                
    <input type="text" id="username" name="username" value="<?php echo $username; ?>"/>                
    <span class="validation-messages">                
      <?php echo validation\Errors::get($rules, 'username'); ?>                
    </span>                
  </div>  
  <div class="container">                
    <label for="password">Password:</label>                
    <input type="password" id="password" name="password"/>                
    <span class="validation-messages">                
      <?php echo validation\Errors::get($rules, 'password'); ?>                
    </span>                
  </div>   
  <div class="container">
    <input type="submit" name="submit" value="Sign in"/>
    <input type="hidden" name="token" value="<?php core\Csrf::token(); ?>"/> 
    <span class="validation-rules">
      <?php echo validation\Errors::get($rules, 'token'); ?>
    </span>
    <span class="failed-login-messages">
      
      <?php if(!empty($username) && empty($rules) ) { ?>
      
        <div class="failed-login-attempt-messages"><?php echo extensions\Auth::getFailedMessages(); ?></div>
        <div class="amount-failed-login-attempts">Failed attempts: <?php echo core\Session::get('failed_login_attempt'); ?></div>
        
      <?php } ?>  
    </span>      
  </div>                
</form>                 

<h1>Login form (admin)</h1>

<?php core\Alert::message('success'); ?>

<form method="POST" action="/admin/auth">                
  <div class="container">                
    <label for="username">Username:</label>                
    <input type="text" id="username" name="username" value="<?php echo $username; ?>"/>                
    <span class="validation-messages">                
      <?php echo validation\Errors::get($rules, 'username'); ?>                
    </span>                
  </div>  
  <div class="container">                
    <label for="password">Password:</label>                
    <input type="password" id="password" name="password"/>                
    <span class="validation-messages">                
      <?php echo validation\Errors::get($rules, 'password'); ?>                
    </span>                
  </div>   
  <div class="container">
    <input type="submit" name="submit" value="Sign in"/>
    <input type="hidden" name="token" value="<?php core\Csrf::token(); ?>"/> 
    <span class="validation-rules">
      <?php echo validation\Errors::get($rules, 'token'); ?>
    </span>
    <span class="failed-login-messages">
      
      <?php if(!empty($username) && empty($rules) ) { ?>
      
        <div class="failed-login-attempt-messages"><?php echo extensions\Auth::getFailedMessages(); ?></div>
        <div class="amount-failed-login-attempts">Failed attempts: <?php echo core\Session::get('failed_login_attempt'); ?></div>
        
      <?php } ?>  
    </span>      
  </div>                
</form>                 

<a href="/logout">Logout</a>

<div>Username: <?php echo core\Session::get('username'); ?></div>
<a href="/logout">Logout</a>

<div>Username: <?php echo core\Session::get('username'); ?></div>
<div>User role: <?php echo $role['type']; ?></div>



<?php

namespace app\models\register;

class Tables {

  public $tables = [
  
    'User' => 'users'
  ];
}
<?php

namespace app\models;

use database\DB;

class User extends Model {

  private static $_table = 'users';

  private static function getFirstInsertedRoleId() {
  
    return DB::try()->select('role_id')->from(self::$_table)->first();
  }
  
  public static function getRoleId() {
  
    if(empty(self::getFirstInsertedRoleId() ) || self::getFirstInsertedRoleId() === null) {
    
      return 1;
    }
    
    return null;
  }
  
  public static function getRole($username) {
  
    return DB::try()->select('type')->from('users')->join('roles')->on('roles.id', '=', 'users.role_id')->where('username', '=', $username)->first();
  }
}

<?php
                
namespace validation;
                
use core\validation\Validate;
                
class Rules {
                
  public $errors;
                 
  public function register($request, $username, $email, $token) {     
                
    $validation = new Validate();
                
    $validation->input(['username' => $request['username']])->as('Username')->rules(['required' => true, 'min' => 5, 'max' => 99, 'special' => true, 'unique' => $username]);
    $validation->input(['email' => $request['email']])->as('Email')->rules(['required' => true, 'min' => 5, 'max' => 99, 'special' => true, 'unique' => $email]);
    $validation->input(['password' => $request['password']])->as('Password')->rules(['required' => true, 'min' => 16, 'max' => 99, 'special' => true]);
    $validation->input(['retypePassword' => $request['retypePassword']])->as('Password')->rules(['match' => $request['password']]);
    $validation->input(['token' => $request['token']])->as('Token')->rules(['csrf' => $token]);

    $this->errors = $validation->errors;
    return $this;
  }
  
  public function login($request, $token) {    
                
    $validation = new Validate();
                
    $validation->input(['username' => $request['username']])->as('Username')->rules(['required' => true, 'min' => 5, 'max' => 99, 'special' => true]);
    $validation->input(['password' => $request['password']])->as('Password')->rules(['required' => true, 'min' => 16, 'max' => 99, 'special' => true]);
    $validation->input(['token' => $request['token']])->as('Token')->rules(['csrf' => $token]);

    $this->errors = $validation->errors;
    return $this;
  }
                
  public function validated() {    
                
    if(empty($this->errors) ) {
                
      return true;
    } 
  }       
}     

<?php

namespace middleware\register;

class Middlewares {

  public $middlewares = [
  
  ];
  
  public $routeMiddlewares = [
  
    'login' => 'LoginMiddleware',
    'auth' => 'AuthMiddleware'
  ];
} 
<?php

namespace middleware;

use core\Session;

class LoginMiddleware {

  public function __construct($run, $bool = null) {
  
    if(Session::exists('logged_in') === true && Session::get('logged_in') === true && $bool === true) {
    
      $run();
      
    } else if(Session::exists('logged_in') === false && $bool === false) {
  
      $run(); 
    }
  }
}
<?php

namespace middleware;

use core\Session;
use database\DB;

class AuthMiddleware {

  public function __construct($run, $role = null) {
  
    if(Session::exists('logged_in') === true && Session::get('logged_in') === true) {
    
      $this->checkRoleType($role, $run);
    }
  }
  
  private function checkRoleType($role, $run) {
  
    if($role === null) {
    
      $this->checkRoleTypeNull($run);
    
    } else if($role === 'admin') {
    
      $this->checkRoleTypeAdmin($run, $role);
    }
  }
  
  private function checkRoleTypeNull($run) {
  
    if(Session::get('user_role') === null) {
    
      $run();
    }
  }

  private function checkRoleTypeAdmin($run, $role) {
  
    $data = DB::try()->select('type')->from('roles')->where('id', '=', Session::get('user_role'))->first();
    
    if(!empty($data) && $data['type'] === $role) {
    
      $run();
    }
  }
}

Projects

MarkUpCMS is a project created using the framework.

Image of code
MarkUpCMS

A CMS that makes it easy for developers to build static websites and to add custom functionality.

Website

Built in security features

In addition to CSRF and SQL injection protection, the framework includes several other basic security features.

  • Protection against SQL injection
  • Defense against brute force attacks
  • Prevention of cross site request forgery
  • Prevention of cross site scripting
  • Session hijacking protection
  • Implementation of strict transport security
  • Data sanitazion of super globals
  • HTML form input validation
Image of a shield