Building a Micro MVC Framework 🏛️

<?php
// The "spaghetti" way: one file does EVERYTHING.
// Routing, the database query, and the HTML are all tangled together.

$id = $_GET["id"] ?? 1;                 // read input from the URL
$pdo = new PDO("sqlite::memory:");      // open a database connection
$row = $pdo->query("SELECT 'Alice' AS name")->fetch();  // query

// ...and straight away we print HTML, mixed in with the logic:
echo "<h1>" . $row["name"] . "</h1>";   // output
echo "<p>User #{$id}</p>";

// It works — but logic, data, and HTML are welded together.
// Change the database? You risk breaking the HTML. Re-skin the page?
// You risk breaking the query. That is exactly what MVC untangles.

<h1>Alice</h1>
<p>User #1</p>

<?php
// MODEL — owns the data and the rules. It talks to the database
// via PDO and returns plain PHP arrays. It NEVER echoes HTML.

final class UserModel
{
    public function __construct(private PDO $db) {}

    // Build a tiny in-memory table so the example runs anywhere.
    public function migrate(): void
    {
        $this->db->exec("CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT, email TEXT)");
        $this->db->exec("INSERT INTO users (name, email) VALUES
            ('Alice', 'alice@example.com'),
            ('Bob',   'bob@example.com')");
    }

    // Return ONE user, or null if the id is unknown.
    public function find(int $id): ?array
    {
        // A prepared statement keeps user input OUT of the SQL string,
        // which is how you stop SQL-injection attacks.
        $stmt = $this->db->prepare("SELECT id, name, email FROM users WHERE id = :id");
        $stmt->execute([":id" => $id]);          // bind :id safely
        $user = $stmt->fetch(PDO::FETCH_ASSOC);  // one row as an array
        return $user ?: null;                    // false -> null
    }

    public function all(): array
    {
        return $this->db->query("SELECT id, name FROM users")->fetchAll(PDO::FETCH_ASSOC);
    }
}

$db = new PDO("sqlite::memory:");
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);  // throw on errors
$model = new UserModel($db);
$model->migrate();

$alice = $model->find(1);
echo $alice["name"] . " <" . $alice["email"] . ">\n";   // Alice <alice@example.com>
var_dump($model->find(99));                              // NULL — no such user

Alice <alice@example.com>
NULL

<?php
// VIEW — turns data into HTML and NOTHING else. No queries, no rules.
// A view receives data the controller already prepared, and renders it.

final class View
{
    public function __construct(private string $template) {}

    // $data becomes local variables inside the template file.
    public function render(array $data = []): string
    {
        extract($data);                 // ["name" => "Alice"] -> $name
        ob_start();                     // start capturing output
        require $this->template;        // run the template; its echoes are captured
        return ob_get_clean();          // return the captured HTML as a string
    }
}

// Normally this is a separate file: app/Views/user.php
// htmlspecialchars() escapes the data so a name like  <script>  can't
// inject markup — the View's one security job is to escape on output.
file_put_contents("user.php", '<?php ?>'
    . '<h1>' . 'Hello, ' . '<?= htmlspecialchars($name) ?>' . '</h1>'
    . '<p>Email: <?= htmlspecialchars($email) ?></p>');

$view = new View("user.php");
echo $view->render(["name" => "Alice", "email" => "alice@example.com"]);
echo "\n";

<h1>Hello, Alice</h1>
<p>Email: alice@example.com</p>

<?php
// FRONT CONTROLLER + ROUTER — one entry point for the whole app.
// In production this is public/index.php and every URL is rewritten to it.

final class Router
{
    private array $routes = [];

    // Register a GET route. ":id" becomes a captured parameter.
    public function get(string $path, callable $handler): void
    {
        $this->routes[] = ["path" => $path, "handler" => $handler];
    }

    // Find a matching route and call its handler. Returns the body string.
    public function dispatch(string $uri): string
    {
        // Strip any query string, e.g. "/users/2?sort=asc" -> "/users/2".
        $url = parse_url($uri, PHP_URL_PATH);

        foreach ($this->routes as $route) {
            // Turn "/users/:id" into a regex that captures the id.
            $pattern = preg_replace('#:([a-zA-Z]+)#', '([^/]+)', $route["path"]);
            if (preg_match('#^' . $pattern . '$#', $url, $m)) {
                array_shift($m);                       // drop the full match
                return ($route["handler"])(...$m);     // pass captured params
            }
        }
        http_response_code(404);
        return "404 Not Found";
    }
}

// CONTROLLER — the thin coordinator. It reads input, calls the Model,
// hands data to the View, and returns the result. No SQL, no HTML here.
final class UserController
{
    private array $users = [
        1 => ["name" => "Alice", "email" => "alice@example.com"],
        2 => ["name" => "Bob",   "email" => "bob@example.com"],
    ];

    public function show(string $id): string
    {
        $user = $this->users[(int) $id] ?? null;   // ask the "model" for data
        if ($user === null) {
            return "User #{$id} not found";
        }
        // Hand the data to a view (here, a simple string) — no logic in the view.
        return "Profile: {$user['name']} ({$user['email']})";
    }
}

// The front controller wires routes to controller methods, then dispatches.
$controller = new UserController();
$router = new Router();
$router->get("/", fn() => "Home Page");
$router->get("/users/:id", fn($id) => $controller->show($id));

// In production:  echo $router->dispatch($_SERVER["REQUEST_URI"]);
// We fake a few requests so the example prints something here:
foreach (["/", "/users/1", "/users/2", "/users/99"] as $uri) {
    echo $uri . " -> " . $router->dispatch($uri) . "\n";
}

/ -> Home Page
/users/1 -> Profile: Alice (alice@example.com)
/users/2 -> Profile: Bob (bob@example.com)
/users/99 -> User #99 not found

<?php
// 🎯 YOUR TURN — register one more route, then run it.
// The router and controller are done; you only add a route and a request.

final class PostController
{
    public function show(string $id): string
    {
        return "Showing post #{$id}";
    }
}

$posts = new PostController();
$router = new Router();   // (same Router class from the worked example above)

// 1) Register a GET route for "/posts/:id" that calls $posts->show.
$router->get(___, fn($id) => $posts->show($id));   // 👉 the path is "/posts/:id"

// 2) Dispatch a request for post #7.
echo $router->dispatch(___) . "\n";               // 👉 the URL is "/posts/7"

// ✅ Expected output:
//    Showing post #7

Showing post #7

<?php
// AUTOLOADING — stop writing require_once for every class.
// spl_autoload_register hands PHP a function it calls the moment you
// use a class it has not seen yet. It loads the file just in time.

spl_autoload_register(function (string $class): void {
    // Map the class name to a file path, e.g.  App\Models\UserModel
    // ->  app/Models/UserModel.php   (PSR-4 maps a namespace to a folder).
    $path = str_replace("\\", "/", $class) . ".php";
    echo "Autoloader asked for: {$class}  ->  {$path}\n";
    // if (file_exists($path)) require $path;   // the real loader does this
});

// You never call the loader directly. PHP triggers it the first time a
// class is referenced. (These names are illustrative — the files don't
// exist here, so we just print what the loader WOULD load.)
class_exists("App/Models/UserModel", true);     // fires the autoloader
class_exists("App/Controllers/UserController", true);

// In real projects Composer writes this loader for you. Declare in composer.json:
//   "autoload": { "psr-4": { "App\\": "app/" } }
// then run  composer dump-autoload  and add  require "vendor/autoload.php";
echo "Composer's vendor/autoload.php replaces all hand-written requires.\n";

Autoloader asked for: App/Models/UserModel  ->  App/Models/UserModel.php
Autoloader asked for: App/Controllers/UserController  ->  App/Controllers/UserController.php
Composer's vendor/autoload.php replaces all hand-written requires.

<?php
// 🎯 YOUR TURN — finish the Model method so it returns ONE user safely.
// The point: keep input out of the SQL string with a prepared statement.

final class CityModel
{
    public function __construct(private PDO $db) {}

    public function find(int $id): ?array
    {
        // 1) Prepare a SELECT with a :id placeholder (don't paste $id into the SQL!)
        $stmt = $this->db->prepare(___);   // 👉 "SELECT name FROM cities WHERE id = :id"

        // 2) Run it, binding the value to the :id placeholder.
        $stmt->execute(___);               // 👉 [":id" => $id]

        $row = $stmt->fetch(PDO::FETCH_ASSOC);
        return $row ?: null;               // null when nothing matched
    }
}

$db = new PDO("sqlite::memory:");
$db->exec("CREATE TABLE cities (id INTEGER PRIMARY KEY, name TEXT)");
$db->exec("INSERT INTO cities (name) VALUES ('London'), ('Paris')");

$model = new CityModel($db);
echo $model->find(2)["name"] . "\n";

// ✅ Expected output:
//    Paris

Paris