Building a JSON REST API in Plain PHP shows how to apply a focused PHP technique using understandable, runnable examples and clearly defined constraints.
What Problem Does This Solve?
Decode JSON with JSON_THROW_ON_ERROR, then validate the expected object shape, field types and size limits. Encode response values with JSON_THROW_ON_ERROR.
Core Concepts
- Identify the data entering the operation and the expected output.
- Decode JSON with JSON_THROW_ON_ERROR, then validate the expected object shape, field types and size limits. Encode response values with JSON_THROW_ON_ERROR.
- Handle expected failures and test boundary conditions rather than assuming success.
Example 1: A Small Working Example
Start with a small input so the behavior is easy to follow.
<?php
$requestMethod = "GET";
$requestPath = "/api/items";
if ($requestMethod === "GET" && $requestPath === "/api/items") { echo json_encode(["data" => [["id" => 1]]], JSON_THROW_ON_ERROR); }
JSON_THROW_ON_ERROR prevents silent serialization failures. Keep UTF-8 inputs valid and avoid exposing sensitive internal fields in the encoded result.
Example 2: A Different Case
The second example changes the task or data while using the same general technique.
<?php
$requestBody = "{\"name\":\"Notebook\"}";
$payload = json_decode($requestBody, true, 512, JSON_THROW_ON_ERROR);
if (!is_string($payload["name"] ?? null)) { throw new InvalidArgumentException("Invalid name"); }
echo json_encode(["id" => 42, "name" => $payload["name"]], JSON_THROW_ON_ERROR);
JSON_THROW_ON_ERROR reports malformed JSON through an exception. Validate the resulting PHP values and required fields after decoding.
Practical Example
This practical example is a complete standalone PHP snippet to adapt to a real application.
<?php
$requestMethod = "DELETE";
$resourceExists = false;
$statusCode = $resourceExists ? 204 : 404;
echo $statusCode;
The example isolates the important operation and its expected input. Adapt the values, error handling and boundaries for your application rather than assuming all input is trusted.
Important Behavior and Edge Cases
- JSON syntax validity does not prove the payload has the required fields or data types. Enforce body limits and validate the decoded structure.
- Decode JSON with JSON_THROW_ON_ERROR, then validate the expected object shape, field types and size limits. Encode response values with JSON_THROW_ON_ERROR.
- Test a malformed input, a missing dependency and a boundary value when those cases apply.
Comparison With Related Approaches
| Approach | Trade-off |
|---|---|
| Building a JSON REST API in Plain PHP | Decode JSON with JSON_THROW_ON_ERROR, then validate the expected object shape, field types and size limits. Encode response values with JSON_THROW_ON_ERROR. |
| Related PHP approach | JSON is suitable for interoperable data; PHP serialize() is not appropriate for untrusted interchange. |
Common Beginner Mistakes
| Mistake | Correct Approach |
|---|---|
| Skipping a relevant boundary or security check | JSON syntax validity does not prove the payload has the required fields or data types. Enforce body limits and validate the decoded structure. |
| Choosing a technique without considering its trade-off | JSON is suitable for interoperable data; PHP serialize() is not appropriate for untrusted interchange. |
| Assuming sample data behaves like production input | Test missing fields, unexpected types, failures and the application’s actual trust boundaries. |
Key Takeaways
- Decode JSON with JSON_THROW_ON_ERROR, then validate the expected object shape, field types and size limits. Encode response values with JSON_THROW_ON_ERROR.
- JSON is suitable for interoperable data; PHP serialize() is not appropriate for untrusted interchange.
- Write tests around the inputs and failure cases most likely in your application.
Use these examples as a starting point and adapt the validations and boundaries to the specific application.