README

Love SFPHP? ⭐ Give us a star on GitHub — it helps us grow and keeps the framework thriving!

Read this in: English · Português · Español

The PHP framework for developers who care about performance, security, and simplicity.

A full-stack, production-ready PHP framework with zero runtime dependencies, built for speed and designed to ship. Just PHP 8.1+, your database, and your code—nothing else needed.

Why Choose SFPHP?

⚡ Lightning-Fast Performance

No dependencies bloat — only the PHP standard library and your database driver
Concurrent HTTP, measured — three outbound requests cost what one costs; benchmarks/ in the repository has the scripts that reproduce the numbers
Efficient queries — relations loaded eagerly with with() to avoid N+1 queries, smart caching
Minimal framework overhead — your code runs immediately, not buried in layers

🔒 Security Built In

Zero-trust by default — CSRF protection, SQL binding, XSS escaping everywhere
Authentication built in — sessions, JWT tokens, policies, remember-me tokens
Request validation — type-safe routing parameters, input filtering
No security theater — we implement what matters, skip what cargo-culting created

🎯 Developer Experience

Type-safe everywhere — typed parameters, classes named as ::class, IDE autocompletion
Generators for speed — 16 make:* commands for models, migrations, controllers, tests and more
Comprehensive CLI — 41 commands to manage your application
Intuitive API — learn it once, it works the same everywhere

🌍 Truly Multilingual

UTF-8 first — length, validation, routing and case conversion are Unicode-correct
Built-in i18n — language catalogs, pluralization rules, Accept-Language negotiation
Framework messages in visitor's language — even 404 errors respect locale

📦 Everything You Need, Nothing You Don't

Security defaults: CSRF, rate limiting, security headers, trusted proxies
Database migrations & seeders
Email with SMTP/TLS
Redis & file caching
Background job queues
Session management
File upload handling
Logging & debugging

What SFPHP Delivers

Backend & Core

Feature	What You Get
Routing	Typed parameters, groups, named routes, middleware per-route
HTTP	Request/Response objects, middleware pipeline, status codes
Database	Query builder with relations, migrations, seeders, transactions
ORM (Models)	Object hydration, attribute types, with() for eager loading
Schema Builder	40+ column types, MySQL 8 ↔ PostgreSQL 12 real parity
Authentication	Sessions, JWT tokens, password hashing, policies, remember-me tokens
Authorization	Gate-based access control, policy classes
Validation	11 rules, messages in the visitor's language, the same rules in the browser
Middleware	Global, per-group, per-route, automatic CSRF verification

Frontend & Views

Feature	What You Get
SFHT Templates	Auto-escaping, layout inheritance, component composition
.phpx Components	Markup inside PHP functions, compiled on build
SFCSS Framework	3,836 classes — components and utilities — from one config: forms, navs, modals, dropdowns, dark theme, contrast computed to WCAG AA, 33KB gzipped
SFJS Library	One file: AJAX, accessible validation, streaming, modal, dropdown, tooltip, tabs and toasts — 15KB gzipped
Built-in Assets	Published to `public/` with zero config

Advanced Features

Feature	What You Get
Async/Await System	PHP Fibers over a real event loop: HTTP requests overlap, timers and timeouts are the loop's. Queries are scheduled, not overlapped.
Event Broadcasting	Pub/sub with `user.*` wildcards, event history, async dispatch
Caching	File, memory and Redis drivers, atomic counters
Job Queues	Background workers with retries, database or Redis drivers
Email	SMTP with TLS, plaintext + HTML, attachments
File Uploads	Type detection from bytes, secure storage, forged file rejection
Logging	JSON lines in UTC, request tracing, secret redaction
Time & Dates	UTC everywhere, timezone display only
Debugging	Error pages in the visitor's language, `dump()` and `dd()`, in-terminal output

Perfect For These Scenarios

📱 High-Traffic APIs

Why SFPHP wins: outbound calls that overlap, intelligent caching, optimized query builder, zero-dependency footprint means minimal memory per request.

Example: your endpoint calls three services. Measured against a local origin answering in 100 ms, an endpoint making three calls has the same latency and throughput as one making a single call — 80 RPS, p50 208 ms, under the load described in benchmarks/server.php.

🌐 Multilingual Platforms

Why SFPHP wins: First-class i18n support with language negotiation, Unicode-correct UTF-8 handling throughout, framework messages in visitor's language.

Example: A marketplace serving 10+ languages—pluralization rules, content localization, and Accept-Language negotiation built-in.

🛡️ Security-Critical Applications

Why SFPHP wins: Security-first design—CSRF by default, SQL binding always, XSS escaping automatic, JWT validation strict, session regeneration on login.

Example: Financial dashboards, health records systems, and admin panels that can't afford compromises.

⚡ Real-Time Applications

Why SFPHP wins: HTTP streaming and Server-Sent Events built in (@stream in SFJS, Response::stream() on the server), async event broadcasting, reactive state with cache invalidation.

Example: Live dashboards, chat applications, collaborative tools where updates need to propagate instantly.

📊 Data-Intensive Systems

Why SFPHP wins: Stream processing with map/filter/reduce, bulk operations, async batch processing, efficient pagination for large datasets.

Example: CSV imports, report generation, data pipeline tools that process millions of records without memory explosion.

🔄 Monolithic Applications

Why SFPHP wins: Batteries included—authentication, authorization, validation, logging, email, queues. No jumping between 20 packages.

Example: Content management systems, SaaS platforms, business applications where you want everything in one framework.

💼 Enterprise Integrations

Why SFPHP wins: Zero dependencies means minimal CVEs, static analysis friendly, no version hell, structured logs that carry a request id.

Example: Systems that must integrate with legacy code, bank APIs, or corporate infrastructure without dragging in dependency trees.

🚀 Startup MVP

Why SFPHP wins: Fast to code, slow to break, nothing to configure, 16 make:* commands, migrations built-in, deployment is just PHP files.

Example: Launch a SaaS, marketplace, or service without weeks of infrastructure decisions.

Getting Started

Install

composer create-project fabioaacarneiro/sfphp-framework my-app
cd my-app
./sfphp serve

That's it. Open http://localhost:8000 and you have:

✅ Working application with example code
✅ A users migration, seeder and factory
✅ JWT configured with real secret key
✅ CSS & JavaScript published and ready
✅ A .gitignore that keeps .env and vendor/ out of Git
✅ Full CLI available at ./sfphp

Generate Your First Model

./sfphp make:model Product
./sfphp make:migration create_products name:string price:decimal timestamps
./sfphp migrate

Create a Controller

./sfphp make:controller Product     # creates app/controllers/ProductController.php and its view

Build a Route

// app/routes/web.php
use SfphpProject\app\controllers\ProductController;

Router::get('/products', [ProductController::class, 'index']);
Router::get('/products/id:number', [ProductController::class, 'show']);   // add show() to the controller

Call three services at once

use SfphpProject\src\Http\Http;
use function SfphpProject\src\Async\await;

$a = Http::getAsync('https://billing.internal/invoices/7');
$b = Http::getAsync('https://catalog.internal/products/42');
$c = Http::getAsync('https://ratings.internal/products/42');

[$invoice, $product, $ratings] = [await($a), await($b), await($c)];

The three requests are on the wire before the first await, so this costs about as long as the slowest one rather than the three added together. Measured: 301 ms for three 300 ms requests, 309 ms for fifty.

Queries do not work this way. await(User::query()->getAsync()) schedules the query — it does not overlap it, because PDO has no asynchronous API and no Fiber changes that. Three queries awaited together take as long as three queries: 609 ms against 603 ms, measured. This shows the difference between async scheduling and non-blocking I/O.

Built for any language

Str::length('日本語');           // 3 (not 9 bytes)
Validator::validate(['n' => 'José'], ['n' => 'alpha'])->passes();  // true
Router::get('/products/name:alpha', ...);  // matches /products/café
__('http.not_found_message');  // in the visitor's language

The SFPHP Philosophy

Simple — Doing one thing well beats doing many things partially.

Secure — Security is not added, it's default. No bypasses. No "just this once."

Fast — With async/await, native database queries, and zero bloat, your app is fast without trying.

Yours — The framework is /src/ — delete what you don't need. Everything else is your code.

Transparent — No magic. No hidden layers. Read the code when curious; it's all in one place.

What's NOT Included (And Why)

Password recovery — Your app needs to email it anyway, we handle the infrastructure
Two-factor — Not one-size-fits-all; Mail is the piece the framework owes it
Message brokers — Built-in queues are usually enough; plug in RabbitMQ when you need it
Full ORM — Query builder with relations is better for most apps; keeps you in control
Polymorphic relations — They store a PHP class name in the database, coupling the schema to your namespace; belongsToMany() covers the common case

Principle: Never add complexity until you prove you need it. SFPHP gives you the pieces to build what's right for your app.

Documentation

Complete in three languages—English, Portuguese and Spanish, each a full version:

Language	Framework	Async	Streaming	PWA	Styling	Components
🇬🇧 English	Docs	Async/Await	Streaming	PWA Guide	SFCSS	.phpx
🇧🇷 Português	Docs	Async/Await	Streaming	Guia PWA	SFCSS	.phpx
🇪🇸 Español	Docs	Async/Await	Streaming	Guía PWA	SFCSS	.phpx

SFHT is markup in a file; .phpx is a component written as a PHP function with its markup inside it. Both ship, and the documentation says when each one is the right shape.

Quick start?

📱 PWA setup guide
📖 Full documentation

System Requirements

PHP 8.1 or later
Composer 2.0+
Database (optional) — any PDO-compatible database (MySQL 8+, PostgreSQL 12+, SQLite)
Cache (optional) — File, Memory, or Redis
Queue (optional) — Database or Redis

Requires extensions that ship with PHP: ext-ctype, ext-curl, ext-fileinfo, ext-filter, ext-json, ext-mbstring, ext-openssl, ext-pdo, ext-session, ext-tokenizer — plus your database's PDO driver. Optional: ext-redis for the Redis drivers, ext-pcntl for graceful queue workers (Unix), ext-posix, ext-gd for PWA icons, ext-intl for locale-correct dates and numbers, ext-readline for tinker. No Composer dependencies.

Testing

In a project you created, composer test runs your own tests (./sfphp test, over tests/*Test.php). In a clone of this repository, the framework's:

composer run test       # the unit suite (php tests/run.php)
composer run test:db    # Integration tests on real MySQL & PostgreSQL
composer run lint       # PHP syntax check
composer run docs       # Verify documentation consistency

The test suite runs on PHP 8.1–8.4 in CI.

Security

We take security seriously. See SECURITY.md for:

How to report vulnerabilities
Security practices used in SFPHP
Where to find detailed security documentation

License

MIT — See LICENSE

Created by Fabio Carneiro
Contributors The community

Ready to Build?

composer create-project fabioaacarneiro/sfphp-framework my-app
cd my-app
./sfphp serve

Your next great app starts now. 🚀

fabioaacarneiro / sfphp-framework

Package info

Security

Statistics

README

Why Choose SFPHP?

⚡ Lightning-Fast Performance

🔒 Security Built In

🎯 Developer Experience

🌍 Truly Multilingual

📦 Everything You Need, Nothing You Don't

What SFPHP Delivers

Backend & Core

Frontend & Views

Advanced Features

Perfect For These Scenarios

📱 High-Traffic APIs

🌐 Multilingual Platforms

🛡️ Security-Critical Applications

⚡ Real-Time Applications

📊 Data-Intensive Systems

🔄 Monolithic Applications

💼 Enterprise Integrations

🚀 Startup MVP

Getting Started

Install

Generate Your First Model

Create a Controller

Build a Route

Call three services at once

Built for any language

The SFPHP Philosophy

What's NOT Included (And Why)

Documentation

System Requirements

Testing

Security

License

Ready to Build?