TravelVista
Building a multi-role travel platform without a framework, to understand what a framework actually does for you.
- Role
- Sole engineer
- Context
- University coursework
- Stack
- PHP · MySQL · Docker
- Status
- Live
Custom MVC in PHP 8 with no packages and no build step: router, controllers, PDO data layer, session handling, CSRF tokens, role-based moderation and validated uploads. Containerised and running behind TLS.
What you write when nothing is provided
A front controller and router, a controller layer, a PDO data layer with prepared statements throughout, session handling with regeneration on privilege change, CSRF tokens on every form, and upload validation that reads the file's actual bytes rather than trusting the declared MIME type.
Why it still matters
Writing the session and CSRF layer by hand is the reason I know what a framework is doing on my behalf, and what it is not. Most of the security work here is the part a framework hides.
- PHP
- MySQL
- Docker
- Let's Encrypt
- Traefik