Deploying to Production

1. Set real database credentials

In src/Config.php, point XcrudConfig at your production database, not the local one used during development:

public static string $dbHost = 'your-db-host';
public static string $dbName = 'your_production_db';
public static string $dbUser = 'your_db_user';
public static string $dbPass = 'a-real-password';

2. Generate a strong $appSecret

$appSecret is the HMAC key that signs every where()/subselect()/pass_var() condition and logic-condition payload sent to the browser. Signing lets those values travel through the client safely - ajax_crud.php refuses to apply one whose signature doesn't match. If this secret leaks (or is left at its default), anyone can forge a signed value and bypass the restriction it was meant to enforce - e.g. editing a URL to escape a page's own where('status', '=', 'active') scoping.

public static string $appSecret = 'change-this-secret-before-production';

Replace it with a long, random, install-unique string - for example the output of bin2hex(random_bytes(32)) - and never commit the real value to source control.

3. Review the security boundary

$blacklistedTables and $blacklistedColumns in src/Config.php are the real security boundary of the install - not any individual page's own ->columns() call, which only changes what one page displays. Every real table in the connected database is reachable through ajax_crud.php by default; review both arrays against your own schema before going live. See Security: Blacklisting Tables & Columns for the full model.

4. Tighten $allowedOrigins

$allowedOrigins is the CORS whitelist controlling which origins may call ajax_crud.php cross-domain. The default ships with localhost entries for local development - narrow it to your real production domain(s) before launch:

public static array $allowedOrigins = ['https://app.example.com'];

See Decoupled Frontends & CORS if your frontend and backend are served from different origins.

5. Turn off $demo

$demo defaults to true, which adds a "View Code" button to every Add/Edit form that shows visitors the raw PHP source of the page that defined it - useful for a public playground, not for a real deployment where page source shouldn't be exposed to end users:

public static bool $demo = false;

6. Confirm mod_rewrite is really on

Every request routes through core/router.php via a single rewrite rule in the project's own .htaccess. Confirm your production Apache config actually honors it:

• mod_rewrite enabled.
• AllowOverride All set for the document root, so .htaccess is read at all - some hosts default this to None, which silently makes every clean URL 404.