Building a REST API

What is a REST API?

Until now your PHP has produced HTML pages for humans. But modern front-ends (React, Angular, mobile apps) do not want HTML — they want raw data they can render themselves. A REST API is a PHP back-end that, instead of pages, returns JSON (a simple text format for data) at predictable URLs. This is one of the most in-demand back-end skills, because nearly every app today is a front-end talking to an API.

Two terms. JSON (JavaScript Object Notation) is a lightweight way to write data as text — it looks just like a PHP associative array. REST is a set of conventions: use the right HTTP method for the right action, and the right status code to report the result.

And a few common status codes — the number the server sends to say how it went:

Sending JSON

Two steps turn PHP data into a JSON response: set a header telling the browser "this is JSON", then echo json_encode(...) to convert a PHP array into JSON text.

<?php
  header("Content-Type: application/json");

  $product = [
    "id" => 1,
    "name" => "Keyboard",
    "price" => 1299.00
  ];

  echo json_encode($product);
?>

header("Content-Type: application/json") tells whoever called the API to expect JSON, not HTML. json_encode($product) then takes the PHP associative array and turns it into a JSON string. That string is the entire response — no HTML at all.

Reading the method and routing the request

A real endpoint behaves differently depending on the HTTP method. $_SERVER["REQUEST_METHOD"] tells you which method was used, and http_response_code() sets the status the client receives.

<?php
  header("Content-Type: application/json");
  $method = $_SERVER["REQUEST_METHOD"];

  if ($method === "GET") {
    $stmt = $pdo->query("SELECT * FROM products");
    echo json_encode($stmt->fetchAll(PDO::FETCH_ASSOC));

  } elseif ($method === "POST") {
    $data = json_decode(file_get_contents("php://input"), true);
    $stmt = $pdo->prepare("INSERT INTO products (name, price) VALUES (?, ?)");
    $stmt->execute([$data["name"], $data["price"]]);
    http_response_code(201);   // Created
    echo json_encode(["message" => "Product created"]);

  } else {
    http_response_code(405);   // Method Not Allowed
    echo json_encode(["error" => "Method not supported"]);
  }
?>

Walk through it. We read the method into $method. On a GET, we fetch all products and json_encode the array — a JSON list comes back. On a POST, the incoming JSON body arrives as raw text from php://input, so json_decode(..., true) turns it back into a PHP array; we insert it with a prepared statement (still essential against SQL injection), set status 201 "Created", and confirm with JSON. Any other method gets a 405 error. The true in json_decode means "give me an associative array".