Capstone: Production Secure Backend API & User Registry Engine

In Plain English

Bring together all core PHP concepts: design a modular, object-oriented user registry backend with data validation, password hashing (password_hash/password_verify), exception fences, and structured JSON REST output.

The Mental Model

"This capstone is the complete architecture of a real-world enterprise web application backend: routing requests, validating inputs, hashing credentials with Argon2/Bcrypt, and returning structured JSON."

Deep Dive: How It Works

Password Hashing: password_hash($raw, PASSWORD_DEFAULT) generates secure salted Bcrypt/Argon2 hashes; password_verify($raw, $hash) checks passwords without timing attacks.

Validation Pipeline: Validates email, enforces password length policies, and sanitizes strings.

Controller Action Pattern: Handles incoming payload, interacts with domain repository, catches exceptions, and emits standard JSON responses.

Syntax Blueprint

<?php

$hash = password_hash($password, PASSWORD_BCRYPT);
$isMatch = password_verify($attempt, $hash);
echo json_encode(["status" => "ok", "token" => $token]);

Hash passwords securely with password_hash, verify credentials with password_verify, and return JSON responses.

Core Rules to Remember

Modern Cryptography: Never use md5() or sha1() for passwords; always use password_hash() with PASSWORD_DEFAULT.

Structured Responses: Standardize API response envelopes (status, data, errors, metadata).

Clean Architecture: Decouple input handling, domain logic, and JSON formatting into distinct classes.

Common Beginner Traps & How to Fix Them

Mistake:Using timing-vulnerable string comparisons ($userPassword === $dbHash) for credentials.

Why it happens: Standard string equality leaks length and character timing information.

How to fix: Always use password_verify() or hash_equals().

Pro Tip: Use password_needs_rehash($hash, PASSWORD_DEFAULT) during user login to automatically upgrade legacy password hashes to modern cost factors.

Live Interactive Example

Hit Run Code to see it live

Complete User Registry & Authentication API Engine

PHP 8.2 / CLI

<?php

class UserDto implements JsonSerializable {
    public function __construct(
        public int $id,
        public string $username,
        public string $email,
        public string $passwordHash
    ) {}

public function jsonSerialize(): array {
        return [
            "id" => $this->id,
            "username" => $this->username,
            "email" => $this->email,
        ];
    }
}

class UserRepository {
    private array $users = [];
    private int $nextId = 1;

public function register(string $username, string $email, string $password): UserDto {
        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
            throw new InvalidArgumentException("Invalid email format");
        }
        if (strlen($password) < 8) {
            throw new InvalidArgumentException("Password must be at least 8 characters");
        }

$hash = password_hash($password, PASSWORD_BCRYPT);
        $user = new UserDto($this->nextId++, $username, $email, $hash);
        $this->users[$user->id] = $user;
        return $user;
    }

public function authenticate(string $email, string $password): ?UserDto {
        foreach ($this->users as $u) {
            if ($u->email === $email && password_verify($password, $u->passwordHash)) {
                return $u;
            }
        }
        return null;
    }
}

// Controller workflow
$repo = new UserRepository();
$newUser = $repo->register("alex_dev", "alex@zencompiler.com", "SecretPass123");
$authUser = $repo->authenticate("alex@zencompiler.com", "SecretPass123");

$response = [
    "status" => "success",
    "authenticated" => $authUser !== null,
    "user" => $authUser,
];

echo json_encode($response, JSON_PRETTY_PRINT) . "\n";

Output Console

Click "Run Code" to view the rendered output.

How it works: User registered with bcrypt hash, authenticated via password_verify, and serialized cleanly to JSON omitting the hash.

Your Turn: Micro Challenge

No pressure! Edit the starter code below and test your solution with instant feedback.

Micro Exercise

Build Authenticated Token Generator Capstone

Write a function createAuthPayload(string $username, string $role): string.
Generate a token string "token_" . bin2hex(random_bytes(4)).
Return a JSON string containing ["status" => "authenticated", "user" => $username, "role" => $role, "token" => "token_mock123"].
In main, call createAuthPayload("alice", "admin") and print the result with a mock token.

Sandbox Output

Click "Run & Check" to test your solution.

Finished reading and practicing?

Mark this lesson as completed to update your course progress.