Download the PHP package bitshost/php-crud-api-generator without Composer

PHP CRUD API Generator

Expose your MySQL/MariaDB database as a secure, flexible, and instant REST-like API.
Features optional authentication (API key, Basic Auth, JWT, OAuth-ready),
OpenAPI (Swagger) docs, and zero code generation.

🚀 Features

• Auto-discovers tables and columns
• Full CRUD endpoints for any table
• Bulk operations - Create or delete multiple records efficiently
• Configurable authentication (API Key, Basic Auth, JWT, or none)
• Rate limiting - Prevent API abuse with configurable request limits
• Request logging - Comprehensive logging for debugging and monitoring
• Advanced query features:
  • Field selection - Choose specific columns to return
  • Advanced filtering - Support for multiple comparison operators (eq, neq, gt, gte, lt, lte, like, in, notin, null, notnull)
  • Sorting - Multi-column sorting with ascending/descending order
  • Pagination - Efficient pagination with metadata
• Input validation - Comprehensive validation to prevent SQL injection and invalid inputs
• RBAC: per-table role-based access control
• Admin panel (minimal)
• OpenAPI (Swagger) JSON endpoint for instant docs
• Clean PSR-4 codebase
• PHPUnit tests and extensible architecture

📖 See detailed enhancement documentation → 📖 Rate Limiting Documentation → 📖 Request Logging Documentation → 📖 Quick Start (5 minutes) → 🔌 Integration with upMVC Framework → - NEW! Full-stack power combo ⚖️ Comparison with PHP-CRUD-API v2 → - NEW! Detailed feature comparison and when to use each 🗺️ Feature Roadmap → - NEW! Upcoming features and integrations

🔒 SECURITY WARNING

⚠️ CRITICAL: The admin dashboard (dashboard.html) and health endpoint (health.php) expose sensitive information and MUST BE PROTECTED before deploying to production!

These files reveal:

• API statistics, error rates, and performance metrics
• Authentication failures and security threats
• System information (memory, CPU, disk usage)

🛡️ SECURE YOUR DASHBOARD NOW → - Complete protection guide

Quick Fix (5 minutes): Add IP whitelist to .htaccess (Apache 2.4+):

📦 Installation

Option 1: Install as Library (Recommended) ⚡

Just 4 simple steps:

That's it! Total modifications: 2 lines of code 🚀

📖 5-Minute Quick Start Guide → 🔒 Secure Your Dashboard → ← DO THIS BEFORE PRODUCTION!

Option 2: Standalone Project (Even Simpler!)

Download complete ready-to-use project:

That's it! Everything in one folder, ready to run. 0 lines to modify 🚀

⚙️ Configuration

If installed as library (via composer require):

Edit config files in vendor directory:

If standalone project (via composer create-project):

Copy and edit config files:

Config file structure:

Edit config/db.php:

Edit config/api.php:

Environment variables (.env)

For easier secret management and 12-factor style deployments, the project also supports a root-level .env file.

• Copy .env.example to .env and adjust values for your environment.
• The following keys override values from config/db.php and config/api.php when defined:
  • DB_HOST, DB_NAME, DB_USER, DB_PASS, DB_CHARSET
  • API_AUTH_METHOD
  • API_KEYS (comma-separated list)
  • BASIC_ADMIN_PASSWORD, BASIC_USER_PASSWORD
  • JWT_SECRET, JWT_EXPIRATION, JWT_ISSUER, JWT_AUDIENCE
• The public entrypoint loads .env before configs, and .htaccess protects .env from direct web access.

🔒 Security Setup (Production)

⚠️ IMPORTANT: This framework ships with example credentials for development.
You MUST change these before deploying to production!

Quick Security Setup:

What to Change:

• [ ] jwt_secret - Generate with: php scripts/generate_jwt_secret.php
• [ ] api_keys - Use long random strings (64+ characters)
• [ ] Default admin password in sql/create_api_users.sql
• [ ] Database credentials in config/db.php

📖 Full security guide: docs/AUTHENTICATION.md

🔐 Authentication Modes

Configure in config/api.php:

• No auth: 'auth_enabled' => false
• API Key: 'auth_enabled' => true, 'auth_method' => 'apikey'
  Client: X-API-Key header or ?api_key=...
• Basic Auth: 'auth_method' => 'basic'
  Client: HTTP Basic Auth (username:password)
• JWT: 'auth_method' => 'jwt' (Recommended for production)
  1. POST to /index.php?action=login with credentials
  2. Use returned token as Authorization: Bearer <token>
• OAuth (future): 'auth_method' => 'oauth'

📖 Complete Authentication Guide → - Detailed examples with Postman, HTTPie, cURL (JSON, Form Data, Multipart)

📚 API Endpoints

All requests go through public/index.php with action parameter.

🤖 Example curl Commands

💪 Bulk Operations

The API supports bulk operations for efficient handling of multiple records:

Bulk Create

Create multiple records in a single transaction. If any record fails, the entire operation is rolled back.

Endpoint: POST /index.php?action=bulk_create&table=users

Request Body (JSON array):

Response:

Bulk Delete

Delete multiple records by their IDs in a single query.

Endpoint: POST /index.php?action=bulk_delete&table=users

Request Body (JSON):

Response:

📊 Count Records

Get the total count of records in a table with optional filtering. This is useful for analytics and doesn't include pagination overhead.

Endpoint: GET /index.php?action=count&table=users

Query Parameters:

• filter - (Optional) Same filter syntax as the list endpoint

Examples:

Response:

🔄 Advanced Query Features (Filtering, Sorting, Pagination, Field Selection)

The list action endpoint now supports advanced query parameters:

Filter Operators

Examples:

• Basic filtering: GET /index.php?action=list&table=users&filter=name:Alice
• Advanced filtering: GET /index.php?action=list&table=users&filter=age:gt:18,status:eq:active
• Field selection: GET /index.php?action=list&table=users&fields=id,name,email
• Sorting: GET /index.php?action=list&table=users&sort=-created_at,name
• Pagination: GET /index.php?action=list&table=users&page=2&page_size=10
• Combined query: GET /index.php?action=list&table=users&filter=email:like:%gmail.com&sort=name&page=1&page_size=5&fields=id,name,email
• IN operator: GET /index.php?action=list&table=orders&filter=status:in:pending|processing|shipped
• Multiple conditions: GET /index.php?action=list&table=products&filter=price:gte:10,price:lte:100,stock:gt:0

Response:

📝 OpenAPI Documentation (Swagger)

Your API automatically generates OpenAPI 3.0 documentation!

Get the OpenAPI Specification (JSON)

View Interactive Documentation (Swagger UI)

Option 1: Online Swagger Editor (Quick & Easy)

1. Copy JSON from: http://localhost:8000/index.php?action=openapi
2. Paste into: https://editor.swagger.io/
3. See beautiful interactive documentation!

Option 2: Use dashboard.html (Recommended) Your project includes dashboard.html which has API documentation built-in:

Example OpenAPI Path Structure

This is what the specification includes for /index.php?action=list&table={table}:

Note: The YAML above is just an example of the structure. The actual API returns JSON format.

🛡️ Security Notes

• Enable authentication for any public deployment!
• Enable rate limiting in production to prevent abuse
• Enable request logging for security auditing and debugging
• Never commit real credentials—use .gitignore and example configs.
• Restrict DB user privileges.
• Input validation: All user inputs (table names, column names, IDs, filters) are validated to prevent SQL injection and invalid queries.
• Parameterized queries: All database queries use prepared statements with bound parameters.
• RBAC enforcement: Role-based access control is enforced at the routing level before any database operations.
• Rate limiting: Configurable request limits prevent API abuse and DoS attacks.
• Sensitive data redaction: Passwords, tokens, and API keys are automatically redacted from logs.

📖 Rate Limiting Documentation → 📖 Request Logging Documentation →

🧪 Running Tests

🔗 Working with Related Data (Client-Side Joins)

Your API provides all the data you need - it's up to the client to decide how to combine it. This approach gives you maximum flexibility and control.

Current approach: Fetch related data in separate requests and combine on the client side.

Quick Example: Get User with Posts

Optimization: Use IN Operator for Batch Fetching

Parallel Fetching for Performance

📖 See complete client-side join examples →

Why this approach?

• ✅ Client decides what data to fetch and when
• ✅ Easy to optimize with caching and parallel requests
• ✅ Different clients can have different data needs
• ✅ Standard REST API practice
• ✅ No server-side complexity for joins

Future: Auto-join/expand features may be added based on user demand.

🗺️ Roadmap

• Client-side joins ✅ (Current - simple and flexible!)
• Relations / Linked Data (auto-join, populate, or expand related records) - Future, based on demand
• API Versioning (when needed)
• OAuth/SSO (if targeting SaaS/public)
• More DB support (Postgres, SQLite, etc.)
• Analytics & promotion endpoints

📄 License

MIT

🙌 Credits

Built by BitHost. PRs/issues welcome!