PHP controller boundary rule | DevPrompt Lab

A practical PHP convention for separating routing, authorization, validation, persistence, and response formatting.

Reusable content

Controllers and route handlers should coordinate HTTP work, not contain large reusable business rules. Validate untrusted input before persistence. Enforce authorization close to the data access boundary. Use parameterized queries and explicit transactions for multi-step updates. Return the project's established response envelope. Keep exceptions from exposing internal data. Put repeatable domain logic in a small service or value object that can be tested without the web server.

Framework or architecture: {{FRAMEWORK}}

Validation layer: {{VALIDATION_LAYER}}

Error convention: {{ERROR_STYLE}}

How to use it

Match existing namespaces, coding standard, and framework patterns before introducing a new abstraction.

Example

Route handler: parse request → require session → call ProjectService → serialize response. ProjectService: validate context and persist within a transaction.