Creating a RESTful API with PHP & FastRoute

RESTful APIs are a popular way to expose data and functionality to external applications. In this tutorial, we will learn how to create a RESTful API using PHP. We will cover the basics of RESTful APIs, how to define endpoints, and how to handle requests using PHP. We will also implement authentication and authorization for our API.

Prerequisites

Before we get started, you will need the following:

• A web server with PHP support (e.g. Apache, Nginx)
• PHP 7.0 or higher
• An understanding of PHP programming and HTTP protocols

Understanding RESTful APIs

A RESTful API is a way to expose a set of resources over the internet using standard HTTP methods. REST stands for Representational State Transfer, which means that the API follows a set of principles for exchanging information between applications. These principles include:

• Using HTTP methods to define actions on resources (GET, POST, PUT, DELETE)
• Using URLs to identify resources
• Using standard HTTP response codes and headers

Defining Endpoints

The first step in creating a RESTful API is to define endpoints. An endpoint is a URL that identifies a specific resource or action. For example, /api/products could be an endpoint for retrieving a list of products.

To define endpoints in PHP, we can use a routing library like FastRoute. FastRoute is a simple and efficient PHP routing library that can match incoming URLs to specific PHP functions.

First, we need to install FastRoute using Composer:

composer require nikic/fast-route

Next, we can create a routes.php file to define our API endpoints:

<?php

use FastRoute\RouteCollector;

$routes = function (RouteCollector $r) {
    $r->addRoute('GET', '/api/products', 'getProducts');
    $r->addRoute('POST', '/api/products', 'createProduct');
    $r->addRoute('PUT', '/api/products/{id:\d+}', 'updateProduct');
    $r->addRoute('DELETE', '/api/products/{id:\d+}', 'deleteProduct');
};

In this example, we define four endpoints:

• /api/products using GET method to retrieve a list of products
• /api/products using POST method to create a new product
• /api/products/{id} using PUT method to update an existing product
• /api/products/{id} using DELETE method to delete an existing product

Each endpoint is associated with a PHP function that will handle the request.

Handling Requests

Once we have defined our endpoints, we need to implement the PHP functions that will handle the requests. Each endpoint function should:

• Accept the appropriate HTTP method and URL parameters
• Validate and sanitize input data
• Perform the appropriate action (e.g. retrieve, create, update, delete)
• Return a response in the appropriate format (e.g. JSON)

Here is an example of a getProducts function:

function getProducts($vars)
{
    // Retrieve list of products from database
    $products = queryDatabase('SELECT * FROM products');
    
    // Convert products to JSON format
    $json = json_encode($products);
    
    // Return JSON response with HTTP 200 status code
    http_response_code(200);
    header('Content-Type: application/json');
    echo $json;
}

In this example, we retrieve a list of products from a database, convert it to JSON format using the json_encode() function, and return it as the response with an HTTP 200 OK status code.

Authentication and Authorization

To secure our RESTful API, we need to implement authentication and authorization. Authentication is the process of verifying the identity of the user, while authorization is the process of verifying that the user has the appropriate permissions to access the requested resource.

For authentication, we can use a token-based system, where the user sends a token with each request to the API. The API can then verify the token and allow or deny access based on the token’s validity.

To implement authentication in PHP, we can create a middleware function that checks for the presence and validity of the token. Here is an example of a middleware function:

function authenticate($vars)
{
    // Check if token is present in header
    if (!isset($_SERVER['HTTP_AUTHORIZATION'])) {
        http_response_code(401);
        die('Authentication token is missing');
    }
    
    $token = $_SERVER['HTTP_AUTHORIZATION'];
    
    // Verify token using JWT library
    try {
        $decoded = JWT::decode($token, 'secret_key', array('HS256'));
    } catch (Exception $e) {
        http_response_code(401);
        die('Invalid authentication token');
    }
    
    // Add user ID to request object
    $vars['user_id'] = $decoded->user_id;
    
    // Call next middleware function or endpoint function
    return $vars;
}

function authorize($vars)
{
    $user_id = $vars['user_id'];
    
    // Retrieve user role from database
    $role = queryDatabase("SELECT role FROM users WHERE id = $user_id");
    
    // Check if user has permission to access resource
    if ($role != 'admin') {
        http_response_code(403);
        die('User does not have permission to access this resource');
    }
    
    // Call next middleware function or endpoint function
    return $vars;
}