Download the PHP package zeretei/php-core without Composer

PHP Core

A lightweight, zero-dependency PHP MVC micro-framework.

A minimal PHP 8.2+ MVC micro-framework with a service container, router, PDO query builder, model abstractions, middleware pipeline, and session flash bags. Zero runtime dependencies.

Features

• ⚡ Lightweight IoC Container — Simple service binding and resolution via a static registry.
• 🛣️ Flexible Routing — GET, POST, PUT, PATCH, DELETE with typed wildcard parameters (:int, :str, :char, :any).
• 🛡️ Auto-Sanitized Input — Recursive HTML-entity encoding on all request input at construction time.
• 💾 Query Builder & Migrations — Parameterized PDO statements and a file-based migration runner with an applied-migrations table.
• 🔑 Model Blueprints — Base Model with a $fillable mass-assignment guard and built-in CRUD.
• 🎛️ Controller & Middleware Pipeline — Base Controller with per-action middleware scoping via shouldExecute().
• ✉️ Flash & Error Bags — Two-pass session flash bags: one for notifications, one for validation errors.
• 🐧 PSR-4 Autoloading — Standardized, case-sensitive-filesystem-safe folder names.

Table of Contents

• Installation
• Project Structure
• Bootstrap
• Configuration
• Container
• Routing
• Request & Validation
• Response
• Database
• Models
• Controllers
• Middleware
• Session
• Migrations
• License

Installation

Require via Composer:

Then add your application namespace to your project's composer.json:

Project Structure

A typical project using PHP Core looks like this:

Bootstrap

Create public/index.php as the single entry point:

Configuration

Create config.php in your project root:

Container

Application extends Container, giving you a static service registry accessible from anywhere:

Bind your own services the same way:

Routing

Define routes in app/routes.php. The file must return a callable that receives the Router instance:

Wildcard tokens

Captured values are passed as positional arguments to the action:

HTML form method spoofing

HTML forms only support GET and POST. For PUT/PATCH/DELETE, add a hidden field:

Request & Validation

Accessing input

Validating input

Call $request->validate() inside a controller action. On failure it automatically redirects back with session errors — on success it returns the validated values:

Available rules

Response

Database

The QueryBuilder wraps PDO with parameterized statements. All queries use bound parameters — no raw string interpolation.

Models

Extend Model, declare $fillable, and get CRUD for free. Keys not in $fillable are silently stripped on write — this is the mass-assignment guard.

Controllers

Extend Controller and define public methods that map to route actions. Use registerMiddleware() in the constructor to attach middleware — optionally scoped to specific actions.

Middleware

Extend Middleware and implement execute(). Pass action names to the constructor to scope the middleware — an empty array means it runs on every action.

Session

Migrations

File naming

Migration files live in app/Databases/migrations/. Each file name must follow this convention:

Writing a migration

Running migrations

Applied migrations are tracked in a migrations table so they are never run twice.

License

This project is open-source software licensed under the MIT License.