Dynamic PHP Front Ends
Server-rendered pages that talk to a JSON API
PHP did not go anywhere, and server-rendered HTML is still the simplest way to put a page in front of a user: no build step, no hydration, no client-side router, and a page that works before any JavaScript has loaded.
Overview
It is short on purpose. Three lessons, no Composer, and every piece of it is in the site you are reading this on.
Introduction
It is for anyone who has to put a page in front of an API and would rather understand the three mechanisms underneath than adopt a framework to hide them. Nothing here needs Composer, and everything here is what a framework would be doing on your behalf.
Two modules and three lessons, short on purpose. The templating lesson is a layout and a handful of views; the escaping lesson is the one rule that prevents most of the vulnerabilities in server-rendered PHP; and the sessions lesson covers cookies, fixation and the CSRF token that makes a form safe to submit.
By the end you will be able to render a page from an API response without a template engine, escape output in the right place every time rather than most of the time, and handle a session and a form post without leaving either open to the attacks they invite.
What you will be able to do
- Render pages from API data with a tiny template layer
- Handle sessions and CSRF tokens correctly
- Escape output so user content cannot become markup
What each level covers
2 levels · 3 lessons
-
Rendering Pages
Rendering a page without a framework. The templating lesson builds a layout and the views that fill it, using nothing but PHP, and shows where the seams go so the pages stay small. The escaping lesson is the single most important habit in server-rendered PHP: escape at output, every time, in the context you are escaping for.
2 lessons 18 min of reading
Start with Templates Without a Framework → -
Sessions and Safety
The state between two requests, and the attacks that live there. Sessions, how the cookie actually works, what fixation is and how regeneration prevents it, and the CSRF token that makes a form safe to submit - with the check on the server, where it counts, rather than on the page that generated it.
1 lesson 15 min of reading
Start with Sessions and CSRF Tokens →
Guides and articles
Longer reading about this subject, written alongside the course.
Before you start
- Any programming experience
Common questions
- What does the Dynamic PHP Front Ends course cover?
- It is 2 levels and 3 lessons: Rendering Pages; Sessions and Safety. Each level ends with a quiz, and the last one is an exam over the whole course.
- How long does it take?
- About 32 minutes of reading and exercises - roughly 0.5 hours. It is self-paced with no cohort and no start date, so you can leave and come back and the site remembers where you were.
- What do I need to know first?
- Any programming experience.
- Is it free?
- Yes. Every lesson, example and quiz in this course is free to read, and you do not need an account to read them. Signing in only adds progress tracking and quiz results.
- What will I be able to do afterwards?
- Render pages from API data with a tiny template layer. Handle sessions and CSRF tokens correctly. Escape output so user content cannot become markup.