How to Build a Simple REST API in PHP and MySQL Using PDO (CRUD with JSON)

Sooner or later every web project needs to talk to something other than a browser. A mobile app wants to load products, a JavaScript front end wants to save a form without reloading the page, or a classmate's system needs to read your data for a capstone integration. The usual answer is a REST API: a set of URLs that accept and return JSON.

In this tutorial, we will build a small but complete REST API in plain PHP and MySQL using PDO, with no framework. It will support all four CRUD operations (Create, Read, Update, Delete), validate input, use prepared statements to block SQL injection, and return proper HTTP status codes. Everything here was tested with curl, and the outputs you see below are the real responses.

What We Are Building

Our API manages a simple products table. Here are the endpoints:

• GET api.php – list all products
• GET api.php?id=1 – get one product
• POST api.php – create a product (JSON body)
• PUT api.php?id=1 – update a product (JSON body)
• DELETE api.php?id=1 – delete a product

Requirements

• PHP 8.0 or newer with the pdo_mysql extension (XAMPP, WAMP, Laragon or any Linux server works)
• MySQL or MariaDB
• A tool for sending requests: curl, Postman, or Thunder Client in VS Code

Step 1: Create the Database and Table

Create a database named rest_api_demo (in phpMyAdmin or the MySQL console), then run this SQL to create the table with two sample rows:

Step 2: Connect to MySQL with PDO

Create a file named db.php. It opens one PDO connection that the API will reuse. Three options are worth pointing out: ERRMODE_EXCEPTION makes database errors throw exceptions instead of failing silently, FETCH_ASSOC returns rows as clean associative arrays that convert nicely to JSON, and turning off EMULATE_PREPARES makes MySQL handle the prepared statements natively (it also returns integers as real numbers in the JSON).

Notice that if the connection fails, we still answer in JSON with a 500 status. Clients of an API should never receive an HTML error page, and you should never echo the real database error to the public, because it can reveal your credentials or table names.

Step 3: Write the API

Now create api.php in the same folder. This single file reads the HTTP method, decides what the client wants, and responds with JSON.

How the code works

• respond() is a small helper that sets the HTTP status code, prints the JSON and stops the script. Using one helper keeps every response consistent.
• readJsonBody() reads the raw request body from php://input. Unlike normal HTML forms, API clients send JSON, so $_POST would be empty. If the JSON is broken, the client gets a 400 Bad Request.
• validateProduct() collects every error at once and returns them together, so a front end can show all messages in one go. Invalid data gets 422 Unprocessable Entity.
• The id from the URL is checked with FILTER_VALIDATE_INT, and every query that uses user input is a prepared statement with ? placeholders. This is what protects the API from SQL injection.
• The switch on $_SERVER['REQUEST_METHOD'] is our tiny router. Any method we do not support gets 405 Method Not Allowed plus an Allow header.
• For PUT, MySQL reports zero affected rows when you save the same values again, so we double-check whether the product really exists before answering 404.

Step 4: Run and Test the API

If you use XAMPP, put the folder inside htdocs and use http://localhost/your-folder/api.php. You can also use PHP's built-in server from inside the project folder:

Get all products

[
    {
        "id": 1,
        "name": "USB-C Charger",
        "price": "499.00",
        "stock": 25,
        "created_at": "2026-10-31 09:13:41"
    },
    {
        "id": 2,
        "name": "Wireless Mouse",
        "price": "350.50",
        "stock": 40,
        "created_at": "2026-10-31 09:13:41"
    }
]

Create a product

HTTP/1.1 201 Created
{
    "message": "Product created",
    "id": 3
}

Read, update and delete one product

The three responses, in order:

{
    "id": 3,
    "name": "Mechanical Keyboard",
    "price": "1899.99",
    "stock": 10,
    "created_at": "2026-10-31 09:13:42"
}

{
    "message": "Product updated"
}

{
    "message": "Product deleted"
}

Error responses

A good API is just as clear when something goes wrong. Sending an empty name and a non-numeric price returns status 422 with this body:

{
    "errors": {
        "name": "Name is required",
        "price": "Price must be a positive number"
    }
}

Asking for the deleted product again, using an unsupported method like PATCH, or passing a bad id gives:

HTTP/1.1 404 Not Found
{
    "error": "Product not found"
}

HTTP/1.1 405 Method Not Allowed
{
    "error": "Method not allowed"
}

HTTP/1.1 400 Bad Request
{
    "error": "Invalid product id"
}

Calling the API from JavaScript

Because the API speaks JSON, any front end can use it. For example, from a page on the same site:

Tips Before You Use This in a Real Project

• Add authentication. Right now anyone who knows the URL can delete products. Protect write operations with an API key, a session login or JWT tokens.
• Enable CORS only if needed. If your front end runs on a different domain, add Access-Control-Allow-Origin headers for that domain only, not *.
• Use clean URLs. With an .htaccess rewrite rule you can turn api.php?id=3 into /api/products/3.
• Add pagination with LIMIT and OFFSET once the table grows.

Conclusion

You now have a working PHP and MySQL REST API that handles GET, POST, PUT and DELETE, validates input, uses PDO prepared statements, and answers with meaningful status codes. This same pattern is the foundation of the back end for many student projects, mobile apps and single-page applications. You can download the complete source code below and extend it with your own tables. Happy coding!

More Tutorials for PHP

PHP Tutorials