README

yuf (pronounced "[jʌf]" or "[jʊf]") is a smart, fast and lightweight PHP framework without runtime dependencies, installed and loaded with Composer.

Routing, views, JSON endpoints and an immutable request object
Template engine with escaping by default and own tags
Typed form fields, rules, CSRF and spam protection with rate limits and optional CAPTCHA, checked file uploads
Session object, login with session fixation protection and rate limits, Argon2id passwords, IP whitelists
PDO connection with typed rows and a safe query builder
Mail via SMTP (incl. XOAUTH2) or the Microsoft Graph API, reading a mailbox via IMAP (without ext-imap)
Phone numbers based on libphonenumber
CSP nonces, rate limiting per IP address, ships no JavaScript

Requirements

PHP 8.5 or higher
Extensions: mbstring, openssl, pdo, intl, bcmath, simplexml, dom, iconv, curl, libxml, ctype, fileinfo

Installation

Start a new project with the yuf skeleton:

composer create-project actra/yuf-skeleton my-project

Or add yuf to an existing project:

composer require actra/yuf

Composer is needed to build the application (vendor/), not on the server: deploy with composer install --no-dev --optimize-autoloader.

Usage

require __DIR__ . '/../vendor/autoload.php';

App::fromEnvironment(envFilePath: __DIR__ . '/../.env.php', copyrightYear: 2026)
    ->withLanguage(code: 'de', locale: 'de_CH.UTF-8')
    ->withHtmlRoute(path: '/', viewGroup: 'frontend')
    ->withFileRoute(path: '/export/', viewGroup: 'export', contentType: ContentType::createCsv())
    ->run();

Without routes, App serves app/view/frontend/ at /. For special cases use $app->core and withRoute(), or Core directly.

See .env.example.php, index.example.php and the documentation:

Setup: entry point, environment settings, production (host, client IP, PHP settings, request and upload limits), error log
Views and requests: views, request, path variables, JSON endpoints
Session and login: session, login, passwords, secret tokens
Templates: syntax, escaping, snippets and tables, own tags
Forms: typed values, formatting amounts, rules, spam protection, uploads, extension points
CAPTCHA: Cloudflare Turnstile in public forms, CSP, privacy
Database: connection, typed rows, query builder, boolean search
Mail: SMTP (STARTTLS or implicit TLS), Microsoft 365, log of sent mails
Mailbox: reading and moving the messages of an IMAP mailbox, text of HTML mails
Phone numbers: parsing, formats, validation
Rate limiting: limits per IP address or globally, public forms and logins, without database
Testing: PHPStan and PHPUnit in projects using yuf, test objects, clock

Upgrading

Read UPGRADE.md before composer update: minor versions may contain breaking changes (marked ⚠️). Libraries that use yuf require it with ~6.0.0 (minor version locked). Projects on the old Actra framework: migration guide.

Contributing

Follow the Actra coding standard and AGENTS.md. composer check (code style, PHPStan, tests) must be green; with DDEV run ddev start and ddev composer check. The example app in example/ then runs at https://yuf.ddev.site/.

License

MIT, see LICENSE: everything not listed below.
LGPL-2.1-only, see src/mailer/LICENSE: the classes in src/mailer/ derived from PHPMailer (they say so in their header); the original copyright lines are kept.
Apache-2.0, see src/phone/LICENSE and src/phone/NOTICE: src/phone/, adapted from libphonenumber-for-php.

Projects under any license, including proprietary ones, may use yuf. When you distribute yuf (or software containing it), keep these license files and headers; the LGPL parts must stay replaceable and their source available, which the PHP source of yuf in vendor/ already ensures. Changes to the LGPL parts stay under the LGPL.

actra / yuf

Package info

Security

Statistics