- REST API v1 and v2 for applications Use and extend the REST content API - the ezprestapi routes at v1 and v2, authentication with OAuth2 or personal API keys, permissions, curl examples, configuration in rest.ini, and adding your own REST provider.
- Scheduled tasks: cronjobs The Exponential counterpart of Laravel's scheduler, Symfony Scheduler, Celery beat, whenever and Spring's @Scheduled - cronjob parts in cronjob.ini run by runcronjobs.php from the system crontab, the shipped parts the…
- Security in PHP code The security rules for PHP code in Exponential in one place - validate input, cast numbers, escape SQL and output by context, protect POSTs with the form token, check permissions in every entry point, redirect safely…
- Set up environment-specific settings Step by step - name each machine's environment with EXP_ENV in config.env.php and keep the settings that differ (mail transport, debug output, the admin badge) in variant files, so a test copy never mails citizens and…
- Testing a Composer install before publishing Install your theme into a throwaway Exponential installation through a Composer path or vcs repository before you submit it to Packagist, and check the folder name, the files and the rendered page.
- The persistent variable, inside How $persistent_variable travels from a node view template to the pagelayout - the kernel sets it to false, reads it back from the root namespace after rendering, stores it in content_info and in the content view cache…
- The robust principle WCAG principle 4, robust, for a public body running Exponential - name, role and value for every control, status messages, valid structured markup, and how admin4's ARIA patterns and the rich text pipeline help your…
- Writing through expservices Create, update and remove content from an app with the expservices node services - POST with a token and no form token, expnode::create with class, attributes as JSON and language, expnode::update which publishes a new…
- Concurrency, statics and long-lived processes How to write Exponential code that is correct when one PHP process serves many requests and many processes serve one site - static caches and singletons, idempotent registrations, exit and cleanExit, class_exists guards…
- Contributing back upstream Send fixes and improvements back to the themes, extensions and the Exponential project you build on - what to contribute, how to prepare a change, and why it pays off in less maintenance for you and shared growth for…
- Escaping output from PHP How to escape values that PHP code writes into HTML, attributes, URLs, JSON, CSV, shell commands and logs - htmlspecialchars() with explicit flags for PHP 8.0, the wash operator and why templates are the better place…
- ezjscore server functions for your app When an app needs an endpoint no REST route or service offers - what to ask a PHP developer for, how an ezjscore server function is registered and called, its answer wrapper, the permission rules it must follow…
- JSON endpoints with ezjscore Give your pages' JavaScript a JSON back end with ezjscore server functions - the [ezjscServer_<name>] block, the static method, the call URL and answer envelope, permission checks, form tokens, and when to use…
- Lock configuration with ManagedByDeployment Step by step - switch on ManagedByDeployment for the production administration siteaccess so settings, templates, extensions and packages can only change through version control, and check what is locked and what stays…
- REST and JSON APIs The API layers of Exponential for developers who build APIs with API Platform, Laravel API resources, Django REST framework or Spring controllers - the REST content API at v1 and v2 with API keys and OAuth2, your own…
- Security for integrations The security rules an Exponential integration must follow - credentials never in Git, settings/override and the environment, least privilege for service accounts, transport security, input from other systems treated as…
- Template style guide House style for Exponential templates: a header comment, prefixed variables and undef, wash at output, i18n contexts, fetch once with limits, small parts, no inline CSS or JavaScript, semantic and accessible markup, and…
- Tests for extensions Tests that ship with an extension and need no database: phpunit.xml.dist and bootstrap, unit and file tests, the kernel's own suite, and the other checks before every commit.
- Text helper operators of the kernel Five small kernel operators - alphabet, autolink, simpletags, eztoc and month_overview - with their parameters, the settings they read, what they escape and what they do not, and examples rendered on a development…
- The expui JavaScript API A reference card of Exponential UI, the admin's JavaScript library: packer keys, exp_config(), the Exp core, Exp.io server calls, dialogs, tables, date pickers, uploads and toolbars.
Documentation license
This documentation is free documentation, licensed under the GNU Free Documentation License 1.3 or later.
Exponential Copyright © 1998-2026 Exponential Foundation and 7x