Native PHP Backend: Full Control Without Frameworks

Native PHP Backend: Full Control and Flexibility

Let's start with a real scenario: a client comes to us with a legacy project running on an old PHP version that can no longer handle the load. Recently we audited such a project on PHP 5.6: response times of 200 ms, frequent N+1 queries, and a struggling shared hosting environment. We rewrote the key modules in native PHP 8.x — response times dropped to 40 ms and hosting costs fell by 30%. A framework couldn't be used because of shared hosting constraints and the high cost of a full rewrite. Our solution was native PHP with typed properties, attributes, and readonly classes. We deliver a turnkey backend, preserving full control and minimizing dependencies. With 10+ years of experience, certified engineers, and over 40 completed projects, we guarantee results. Native code can be faster due to the absence of overhead. Contact us for a free audit of your project.

Why Choose Native PHP Without a Framework?

For projects with up to 15–20 endpoints and simple logic, a native approach delivers up to 30% better performance compared to Laravel or Symfony — thanks to zero overhead. You select exactly which libraries to include: FastRoute for routing, php-di for dependency injection, Phinx for migrations. Nothing unnecessary. Budget savings can reach 20% because there are no framework license costs or bloated dependencies. For example, a typical small API (10 endpoints) costs between $5,000 and $10,000.

What Problems Do We Solve?

• N+1 queries in PDO. We implement a Repository pattern with data aggregation via JOINs instead of separate queries. This reduces the number of database queries by a factor of 10.
• Security. We use PDO prepared statements, server-side validation, and JWT with a limited TTL — all written manually, without framework 'magic'. In one project, we uncovered an XSS vulnerability that a framework would have missed.
• Performance. We minimize class autoloading, enable OPCache, and profile with Xdebug. Load testing is mandatory. In one case, throughput increased from 500 to 2000 RPS.

How Do We Implement Authentication and Security?

Authentication is built on JWT with a short TTL (15 minutes). The refresh token is stored in an http-only cookie. Token validation and parsing can be written in just 20 lines of code without any library. For production, we rely on firebase/php-jwt, but a custom solution works for basic needs. CORS policies and CSRF protection are configured in middleware.

How Does PDO Improve Performance?

PDO with prepared statements not only protects against SQL injection but also allows repeated execution of the same query with different parameters. We use a Singleton connection pool, shaving 5–10 ms off each connection setup.

Native PHP vs Frameworks: A Comparison

Typical Phases and Timelines

How We Do It: Stack and Implementation

We use PHP 8.x, PostgreSQL 15, Nginx in Docker. Example entry point:

<?php // public/index.php declare(strict_types=1); require_once __DIR__ . '/../vendor/autoload.php'; use App\Core\Router; use App\Core\Request; use App\Core\Response; use App\Middleware\CorsMiddleware; use App\Middleware\AuthMiddleware; $request = Request::fromGlobals(); $router = new Router(); require __DIR__ . '/../routes/api.php'; $middlewares = [new CorsMiddleware(), new AuthMiddleware()]; $response = (new Pipeline($middlewares))->handle($request, fn($req) => $router->dispatch($req)); $response->send(); 

The router uses FastRoute — faster than alternatives:

<?php namespace App\Core; use FastRoute\Dispatcher; use FastRoute\RouteCollector; use function FastRoute\simpleDispatcher; class Router { private array $routes = []; public function get(string $pattern, array $handler, array $middlewares = []): void { $this->routes[] = ['GET', $pattern, $handler, $middlewares]; } public function post(string $pattern, array $handler, array $middlewares = []): void { $this->routes[] = ['POST', $pattern, $handler, $middlewares]; } public function dispatch(Request $request): Response { $dispatcher = simpleDispatcher(function (RouteCollector $r) { foreach ($this->routes as [$method, $pattern, $handler, $middlewares]) { $r->addRoute($method, $pattern, [$handler, $middlewares]); } }); $info = $dispatcher->dispatch($request->method(), $request->path()); return match ($info[0]) { Dispatcher::FOUND => $this->handleFound($info[1], $info[2], $request), Dispatcher::NOT_FOUND => Response::json(['error' => 'Not Found'], 404), Dispatcher::METHOD_NOT_ALLOWED => Response::json(['error' => 'Method Not Allowed'], 405), }; } private function handleFound(array $routeInfo, array $params, Request $request): Response { [$handler, $middlewares] = $routeInfo; [$class, $method] = $handler; foreach ($middlewares as $middleware) { $result = app($middleware)->handle($request); if ($result instanceof Response) return $result; } return app($class)->$method($request, $params); } } 

Validation and Database Layer

A custom validator using match and attributes:

<?php namespace App\Core; class Validator { private array $errors = []; public function validate(array $data, array $rules): bool { $this->errors = []; foreach ($rules as $field => $fieldRules) { foreach (explode('|', $fieldRules) as $rule) { $this->applyRule($data, $field, $rule); } } return empty($this->errors); } private function applyRule(array $data, string $field, string $rule): void { $value = $data[$field] ?? null; [$ruleName, $param] = array_pad(explode(':', $rule, 2), 2, null); match ($ruleName) { 'required' => !isset($data[$field]) || $data[$field] === '' ? $this->addError($field, 'required', "Field {$field} is required") : null, 'min' => is_string($value) && strlen($value) < (int) $param ? $this->addError($field, 'min', "Minimum {$param} characters") : null, 'max' => is_string($value) && strlen($value) > (int) $param ? $this->addError($field, 'max', "Maximum {$param} characters") : null, 'numeric' => $value !== null && !is_numeric($value) ? $this->addError($field, 'numeric', "Field {$field} must be numeric") : null, 'email' => $value && !filter_var($value, FILTER_VALIDATE_EMAIL) ? $this->addError($field, 'email', 'Invalid email') : null, default => null }; } private function addError(string $field, string $rule, string $message): void { $this->errors[$field][$rule] = $message; } public function getErrors(): array { return $this->errors; } } 

PDO connection with Singleton and a simple Query Builder for common operations:

class QueryBuilder { private PDO $pdo; private string $table; private array $conditions = []; private array $bindings = []; private ?int $limit = null; private ?int $offset = null; public function __construct(string $table) { $this->pdo = Database::getInstance(); $this->table = $table; } public function where(string $column, mixed $value): static { $placeholder = ':' . $column . count($this->bindings); $this->conditions[] = "{$column} = {$placeholder}"; $this->bindings[$placeholder] = $value; return $this; } public function limit(int $limit): static { $this->limit = $limit; return $this; } public function offset(int $offset): static { $this->offset = $offset; return $this; } public function get(): array { $sql = "SELECT * FROM {$this->table}"; if ($this->conditions) { $sql .= ' WHERE ' . implode(' AND ', $this->conditions); } if ($this->limit !== null) $sql .= " LIMIT {$this->limit}"; if ($this->offset !== null) $sql .= " OFFSET {$this->offset}"; $stmt = $this->pdo->prepare($sql); $stmt->execute($this->bindings); return $stmt->fetchAll(); } public function insert(array $data): int { $columns = implode(', ', array_keys($data)); $placeholders = implode(', ', array_map(fn($k) => ":{$k}", array_keys($data))); $stmt = $this->pdo->prepare("INSERT INTO {$this->table} ({$columns}) VALUES ({$placeholders})"); $stmt->execute($data); return (int) $this->pdo->lastInsertId(); } } 

Our Work Process

1. Analysis — we review the current architecture, load, and bottlenecks.
2. Design — we agree on the database schema, routing, and middleware.
3. Implementation — we write code and cover it with unit tests (PHPUnit).
4. Testing — load and integration testing.
5. Deployment — setup CI/CD, monitoring, and documentation.

What’s Included in Our Work

• Source code with comments
• API documentation (OpenAPI)
• Database migrations (Phinx)
• Access to repository and server
• Team training (2 hours)
• One month of post-launch support

Timelines and Pricing

• Basic infrastructure (router, DI, Request/Response) — 3–7 days
• Models, PDO, Query Builder — 3–5 days
• Authentication (JWT) — 2–3 days
• Business logic — 1–3 weeks

Total: 2–5 weeks for a small API. Cost is calculated individually based on complexity. Budget savings of up to 20% are typical due to the absence of framework overhead. For a typical small API (10 endpoints), the total cost ranges from $5,000 to $10,000.

Optimal Scenarios for Native PHP

• Small API — up to 15 endpoints.
• Shared hosting — no access to Composer or frameworks.
• Legacy migration — step-by-step replacement of system parts.
• High performance — a microservice handling 1000+ RPS.

Order native PHP backend development — get a stable, framework-free architecture. Get a consultation — our engineers will help assess whether native PHP fits your project. Just write to us.