Pros and cons of designing PHP application with one public file approach?

Question

I have an idea of making application in php that will not have any public files other than index.php i.e. different pages of project load as parameters sent to index.php

Also if someone wants to book mark page its okay because i can probably use .htaccess to send arguments to index.php based on what page requested.

Do you think this approach is actually solution or asking for troubles its looks original to me i could implement it however i wonder what would be pros and cons of such application design where only public file is index.php?

Answer 1

When I first start PHP I had the luck of having access to a PHP code of a game (that never came out sadly).

If you start with such design without frameworks you will need to handle the routing yourself based on the parameters, there was no framework, manual centralized routing.

Pros :

• You can centralise the handling of routings.
• You can add a primary-level of rights check by preventing access to some page with basic checks (ie : isConnected, isAdmin, of course you can do things more complicated at this level but I won't recommend it). By doing this you can remove it that copy/paste in the top of each file checking this and only keep specific right check.

Cons :

• Extra code to develop, which of course may contains security flaws in code/design. Yes if you add a primary right access, you remove some copy/paste code, by instead you have to develop something more elaborated.

• You need to centralize all your navigation declaration in the routing file or in the database. If you choose the database way I highly recommand you to remove write privilege on the table to the application user and edit that table yourself with another privileged account that your php application never use. At least if there is some SQL Injection, the injection won't be able to modify that level of right access.

If you use a framework, well Pro and Coins still hold but they're not your concerns anymore since they did the work for you. The only thing is to get how to add your new page and manage the access of it.

Answer 2

In your implementation, index.php would serve as a Front Controller. This approach is used in most, if not all, major PHP web frameworks:

• Symfony
• Laravel
• Slim

Also see this related discussion on SO

Answer 3

The main pro is increased security, well that is if you configure your .htaccess properly.

By redirecting everything to public index file and denying access to application sources files, you outsource the access rights of files and directories to apache, which does a pretty good job at it.

Now those application files do not only contain your business logic but may as well contain sensitive information, such as database credentials, server API keys,.. Information you do not want anyone to see.

When apache takes care of denying access to those directories/files and rewriting the URI, you yourself can elegantly describe what and how is accessed.

A manual approach renders to be very complicated and you could easily make a mistake and have a file, which you wanted to be inaccessible, accessible.

The con is that every request hitting the server now needs to pass through this public index file. And when you create directory like scripts where you wanna place code to be run by going to a URI in your browser, it usually does not work, because the framework does not realize you want to actually access a .php file (it will not even let you) and thinks you are trying to access a controller.

Obviously, this gets circumvented by running the script directly from let's say SSH, so it does not get through apache. But even then you need to think about your design and probably not put your bootstrapping logic (environment initialization,...) into the public index file - this is what luckily many frameworks do.

In the end, if you aren't coding for educational purposes I don't recommend you to whip out your own solution. There are many frameworks which use the single public index file methology and are quite mature and proved to work.

Along the frameworks FMJaguar has already mentioned, I'd highly recommend you the PhalconPHP framework.