PHPackages                             antimonial/framework - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Framework](/categories/framework)
4. /
5. antimonial/framework

ActiveFramework[Framework](/categories/framework)

antimonial/framework
====================

A PHP MVC framework where what you read is what runs.

v0.21.0(1mo ago)05↓75%1MITPHPPHP >=8.1CI passing

Since Jun 24Pushed 1mo agoCompare

[ Source](https://github.com/antimonial/framework)[ Packagist](https://packagist.org/packages/antimonial/framework)[ Docs](https://github.com/antimonial/framework)[ RSS](/packages/antimonial-framework/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (10)Dependencies (3)Versions (36)Used By (1)

Antimonial
==========

[](#antimonial)

A PHP MVC framework where what you read is what runs.

Requirements
------------

[](#requirements)

- PHP >= 8.1

Installation
------------

[](#installation)

```
composer require antimonial/framework
```

Quick Start
-----------

[](#quick-start)

```
// public/index.php
define('ROOT_PATH', __DIR__ . '/..');
require ROOT_PATH . '/vendor/autoload.php';

Antimonial\Core\Config::load('app');
Antimonial\Core\Config::load('database');

$app = new Antimonial\Core\App();
$app->run();
```

```
// app/Routes/web.php
$router->get('/', [App\Controllers\HomeController::class, 'index']);
$router->get('/posts/{slug}', fn (Request $r) => "Post: {$r->get('slug')}");
```

```
// app/Controllers/HomeController.php
class HomeController extends Controller
{
    public function index(Request $request): Response
    {
        $users = DB::table('users')->where('active', true)->get();
        return $this->view('home', ['users' => $users]);
    }
}
```

```
// app/Views/home.php
Users
@foreach($users as $user)
  {{ $user->name }}
@endforeach
```

What's Included
---------------

[](#whats-included)

ComponentDescription**Routing**GET/POST/PUT/PATCH/DELETE, params, groups, named routes, middleware**Controllers**View rendering, JSON responses, redirects, validation (string, file, and database rules)**Query Builder**Fluent SQL builder — select, where (all variants), join, aggregates, paginate, insert/update/delete, transactions**Model**Base model with CRUD, timestamps, explicit table name (no guessing)**Response**HTML, JSON, redirects, cookies, file downloads (`download()`, `file()`)**Template Engine**Blade-style directives, layouts (`@extends`/`@section`/`@yield`), pipe filters, auto-escaping, compiled cache**Session**Native PHP session wrapper with flash data (opt-in)**CSRF**Token generation, verification, middleware (opt-in)**Authentication**`Auth` facade (`attempt`/`login`/`logout`/`check`/`id`/`user`) + `AuthMiddleware`/`GuestMiddleware` (opt-in)**File Uploads**`UploadedFile` wrapper, `Request::file()`, validation rules `file`/`image`/`mimes`/`max_size`**Database Migrations**`Migrator` + `Migration` interface (run/rollback, tracked in a `migrations` table)**Form Re-population**`old()` / `errors()` helpers + flash-and-redirect on validation failure**File Logging**`Logger` facade + `ErrorHandler` integration**Config**Dot-notation config loader from `app/Config/`**.env**Minimal `.env` file parser**Error Handling**Debug mode with stack traces, production error pages**Helpers**`view()`, `redirect()`, `e()`, `env()`, `route()`, `config()`, `dd()`, `ddj()`, `old()`, `errors()`Security
--------

[](#security)

- Auto-escaped output (`{{ }}`) prevents XSS; only `{{{ }}}` emits raw HTML
- SQL identifiers validated against a strict whitelist; values always bound via prepared statements
- CSRF protection with timing-safe `hash_equals()` comparison (opt-in)
- Security headers (`X-Content-Type-Options`, `X-Frame-Options`) sent by default
- File uploads validated by real content for `image` (reads the binary's MIME type); `mimes` checks the client-declared extension only
- Authentication stores the user id in the session and regenerates the session id on login/logout (session-fixation protection)

Usage Examples
--------------

[](#usage-examples)

### File uploads

[](#file-uploads)

```
// In a controller
$data = $this->validate($request, [
    'avatar' => 'required|image|max_size:2048', // image = real content check
    'doc'    => 'required|mimes:pdf,txt',        // mimes = extension check only
]);

$path = $request->file('avatar')->store('storage/uploads');
```

### Database migrations

[](#database-migrations)

```
$migrator = new \Antimonial\Database\Migrator($connection, __DIR__ . '/migrations');

// 2026_01_01_000001_create_users.php
return new class implements \Antimonial\Database\Migration {
    public function up(\Antimonial\Database\Connection $db): void
    {
        $db->execute('CREATE TABLE users (id INTEGER PRIMARY KEY, email TEXT)');
    }
    public function down(\Antimonial\Database\Connection $db): void
    {
        $db->execute('DROP TABLE users');
    }
};

$ran = $migrator->run();        // applies pending migrations
$reverted = $migrator->rollback(); // reverts the most recent batch
```

### Authentication

[](#authentication)

```
Auth::useModel(User::class);

if (Auth::attempt(['email' => $request->post('email'), 'password' => $request->post('password')])) {
    return $this->redirect('/dashboard');
}

// Protect a route with middleware
$router->get('/dashboard', [DashboardController::class, 'index'])
    ->middleware(\Antimonial\Middleware\AuthMiddleware::class);
```

### Form re-population

[](#form-re-population)

```
// In a view, after a failed validation (errors + input are flashed)