Website Backend Development with PHP (Yii2)

Website Backend Development with PHP (Yii2)

Yii2 — a PHP framework with an excellent balance of features and learning curve. Full stack: ActiveRecord ORM, Gii (CRUD code generator), RBAC out of the box, caching, job queues through yii2-queue, REST support. Configuration through PHP arrays remains transparent and predictable without annotation magic.

Relevant for projects where development speed matters with Russian/post-Soviet developer teams — Yii2 is historically popular in this region, making it easier to find specialists.

Application Configuration

// config/web.php
return [
    'id' => 'my-app',
    'basePath' => dirname(__DIR__),
    'bootstrap' => ['log', 'queue'],
    'components' => [
        'db' => [
            'class' => yii\db\Connection::class,
            'dsn' => 'pgsql:host=localhost;dbname=myapp',
            'username' => getenv('DB_USER'),
            'password' => getenv('DB_PASS'),
            'charset' => 'utf8',
            'enableSchemaCache' => true,
            'schemaCacheDuration' => 3600,
        ],
        'cache' => [
            'class' => yii\redis\Cache::class,
            'redis' => ['hostname' => 'localhost', 'port' => 6379],
        ],
        'user' => [
            'identityClass' => app\models\User::class,
            'enableAutoLogin' => false,
            'enableSession' => false, // for API — stateless
        ],
        'queue' => [
            'class' => yii\queue\redis\Queue::class,
            'redis' => 'redis',
            'channel' => 'queue',
        ],
    ],
    'modules' => [
        'api' => [
            'class' => app\modules\api\Module::class,
            'version' => 'v1',
        ],
    ],
];

ActiveRecord

namespace app\models;

use yii\db\ActiveRecord;
use yii\behaviors\TimestampBehavior;
use yii\behaviors\SluggableBehavior;

class Product extends ActiveRecord
{
    public static function tableName(): string
    {
        return 'products';
    }

    public function behaviors(): array
    {
        return [
            TimestampBehavior::class,
            [
                'class' => SluggableBehavior::class,
                'attribute' => 'name',
                'slugAttribute' => 'slug',
                'ensureUnique' => true,
            ],
        ];
    }

    public function rules(): array
    {
        return [
            [['name', 'price'], 'required'],
            ['name', 'string', 'min' => 2, 'max' => 255],
            ['price', 'number', 'min' => 0.01],
            ['category_id', 'exist', 'targetClass' => Category::class, 'targetAttribute' => 'id'],
            ['attributes', 'safe'],
            ['is_active', 'boolean'],
            ['is_active', 'default', 'value' => true],
        ];
    }

    public function getCategory(): ActiveQuery
    {
        return $this->hasOne(Category::class, ['id' => 'category_id']);
    }

    public function getVariants(): ActiveQuery
    {
        return $this->hasMany(ProductVariant::class, ['product_id' => 'id']);
    }

    // Scopes
    public static function find(): ProductQuery
    {
        return new ProductQuery(static::class);
    }
}

class ProductQuery extends ActiveQuery
{
    public function active(): static
    {
        return $this->andWhere(['is_active' => true]);
    }

    public function byCategory(int $categoryId): static
    {
        return $this->andWhere(['category_id' => $categoryId]);
    }
}

REST API through yii\rest

Yii2 has built-in REST API support:

namespace app\modules\api\controllers;

use yii\rest\ActiveController;
use yii\filters\auth\HttpBearerAuth;
use yii\filters\Cors;

class ProductController extends ActiveController
{
    public string $modelClass = Product::class;

    public function behaviors(): array
    {
        $behaviors = parent::behaviors();

        // CORS
        $behaviors['corsFilter'] = [
            'class' => Cors::class,
            'cors' => [
                'Origin' => explode(',', getenv('ALLOWED_ORIGINS') ?: '*'),
                'Access-Control-Allow-Credentials' => true,
            ],
        ];

        // Auth
        $behaviors['authenticator'] = [
            'class' => HttpBearerAuth::class,
            'except' => ['index', 'view'],
        ];

        return $behaviors;
    }

    public function actions(): array
    {
        $actions = parent::actions();

        // Customize index — add filters
        $actions['index']['prepareDataProvider'] = [$this, 'prepareDataProvider'];

        return $actions;
    }

    public function prepareDataProvider(): ActiveDataProvider
    {
        $params = Yii::$app->request->queryParams;
        $search = new ProductSearch();
        return $search->search($params);
    }

    // Additional actions
    public function actionFeatured(): array
    {
        return Product::find()->active()->orderBy(['views' => SORT_DESC])->limit(10)->all();
    }
}

JWT Authentication

use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use yii\filters\auth\AuthMethod;

class JwtAuth extends AuthMethod
{
    public function authenticate($user, $request, $response)
    {
        $authHeader = $request->getHeaders()->get('Authorization');
        if (!$authHeader || !str_starts_with($authHeader, 'Bearer ')) {
            return null;
        }

        try {
            $token = substr($authHeader, 7);
            $decoded = JWT::decode($token, new Key(getenv('JWT_SECRET'), 'HS256'));
            return User::findOne($decoded->sub);
        } catch (\Exception $e) {
            throw new UnauthorizedHttpException('Invalid token');
        }
    }
}

Gii — Code Generator

One of Yii2's key features — the CRUD generator:

# Generate model from database table
php yii gii/model --tableName=products --modelClass=Product

# Generate CRUD controller
php yii gii/crud --modelClass=Product --controllerClass=ProductController

# REST controller
php yii gii/rest-controller --modelClass=Product

Gii significantly accelerates boilerplate code creation with large numbers of entities.

Queues through yii2-queue

namespace app\jobs;

use yii\base\BaseObject;
use yii\queue\JobInterface;

class SendEmailJob extends BaseObject implements JobInterface
{
    public int $userId;
    public string $template;
    public array $params = [];

    public function execute($queue): void
    {
        $user = User::findOne($this->userId);
        if (!$user) return;

        Yii::$app->mailer->compose($this->template, $this->params)
            ->setTo($user->email)
            ->send();
    }
}

// Push to queue
Yii::$app->queue->push(new SendEmailJob([
    'userId' => $user->id,
    'template' => 'welcome',
    'params' => ['name' => $user->name],
]));

// With delay
Yii::$app->queue->delay(300)->push(new SendEmailJob([...]));

RBAC

// Assign role
$auth = Yii::$app->authManager;

$adminRole = $auth->getRole('admin');
$auth->assign($adminRole, $user->id);

// Check in controller
if (!Yii::$app->user->can('updateProduct', ['product' => $product])) {
    throw new ForbiddenHttpException();
}

// Custom rule
class ProductOwnerRule extends Rule
{
    public string $name = 'isProductOwner';

    public function execute($user, $item, $params): bool
    {
        return isset($params['product']) && $params['product']->user_id === $user;
    }
}

Development Timeline

• Configuration + models + migrations — 3–5 days
• REST API modules — 1–2 weeks
• Auth + RBAC — 3–5 days
• Gii code generation saves 30–40% time on standard CRUD
• Tests — 3–7 days
• Integrations — per task

Corporate website or portal: 4–8 weeks. Yii2 excels on projects with many entities where Gii provides noticeable acceleration.