A Comprehensive Guide to MVC Pattern in PHP

/home/username/
├── myapp/
│   ├── config.php          # database settings (not web-accessible)
│   ├── src/
│   │   ├── Router.php
│   │   ├── UserController.php
│   │   └── UserModel.php
│   └── views/
│       └── users.php
└── public_html/
    ├── .htaccess
    └── index.php           # front controller

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]

<?php
declare(strict_types=1);

// public_html/index.php
spl_autoload_register(function (string $class): void {
    $file = __DIR__ . '/../myapp/src/' . $class . '.php';
    if (is_file($file)) {
        require $file;
    }
});

session_start();
$config = require __DIR__ . '/../myapp/config.php';

$pdo = new PDO($config['dsn'], $config['user'], $config['pass'], [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
]);

$users  = new UserController(new UserModel($pdo), __DIR__ . '/../myapp/views');
$router = new Router();
$router->get('/users',  [$users, 'index']);
$router->post('/users', [$users, 'store']);

$router->dispatch($_SERVER['REQUEST_METHOD'], $_SERVER['REQUEST_URI']);

<?php
declare(strict_types=1);

final class Router
{
    private array $routes = [];

    public function get(string $path, callable $handler): void  { $this->routes['GET'][$path]  = $handler; }
    public function post(string $path, callable $handler): void { $this->routes['POST'][$path] = $handler; }

    public function dispatch(string $method, string $uri): void
    {
        $path = rtrim(parse_url($uri, PHP_URL_PATH) ?: '/', '/') ?: '/';
        $handler = $this->routes[$method][$path] ?? null;

        if ($handler === null) {
            http_response_code(404);
            echo 'Page not found';
            return;
        }
        $handler();
    }
}

<?php
declare(strict_types=1);

final class UserModel
{
    public function __construct(private readonly PDO $db) {}

    public function all(): array
    {
        return $this->db->query('SELECT id, name, email FROM users ORDER BY id')->fetchAll();
    }

    public function create(string $name, string $email): void
    {
        $stmt = $this->db->prepare('INSERT INTO users (name, email) VALUES (:name, :email)');
        $stmt->execute(['name' => $name, 'email' => $email]);
    }
}

CREATE TABLE users (
  id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
  name VARCHAR(100) NOT NULL,
  email VARCHAR(190) NOT NULL UNIQUE
);

<?php
declare(strict_types=1);

final class UserController
{
    public function __construct(private UserModel $users, private string $viewDir) {}

    public function index(array $errors = []): void
    {
        $_SESSION['csrf'] ??= bin2hex(random_bytes(32));
        $this->render('users', [
            'users'  => $this->users->all(),
            'errors' => $errors,
            'csrf'   => $_SESSION['csrf'],
        ]);
    }

    public function store(): void
    {
        if (!hash_equals($_SESSION['csrf'] ?? '', $_POST['csrf'] ?? '')) {
            http_response_code(419);
            exit('Session expired. Reload the page and try again.');
        }

        $name  = trim($_POST['name'] ?? '');
        $email = trim($_POST['email'] ?? '');
        $errors = [];
        if ($name === '')                                 { $errors[] = 'Name is required.'; }
        if (!filter_var($email, FILTER_VALIDATE_EMAIL))   { $errors[] = 'Enter a valid email address.'; }

        if ($errors) {
            $this->index($errors);
            return;
        }
        $this->users->create($name, $email);
        header('Location: /users', true, 303);
    }

    private function render(string $view, array $data): void
    {
        extract($data, EXTR_SKIP);
        require $this->viewDir . '/' . $view . '.php';
    }
}

<?php $e = fn(string $s): string => htmlspecialchars($s, ENT_QUOTES, 'UTF-8'); ?>
<!doctype html>
<html lang="en">
<head><meta charset="utf-8"><title>Users</title></head>
<body>
  <h1>Users</h1>

  <?php foreach ($errors as $error): ?>
    <p class="error"><?= $e($error) ?></p>
  <?php endforeach; ?>

  <ul>
    <?php foreach ($users as $user): ?>
      <li><?= $e($user['name']) ?> (<?= $e($user['email']) ?>)</li>
    <?php endforeach; ?>
  </ul>

  <form method="post" action="/users">
    <input type="hidden" name="csrf" value="<?= $e($csrf) ?>">
    <input name="name" placeholder="Name" required>
    <input name="email" type="email" placeholder="Email" required>
    <button type="submit">Add user</button>
  </form>
</body>
</html>