Member restricted game with API My website is poorly coded.

The structure is pretty simple:


A RewriteRule redirects /.... to /index.php?page=$1
mypages/page.php contains the page content and actions (model controller and view glued together...)
index.php wrap the demanded page into a theme (basically include header and footer around it)


The site is a complex MMORPG site (~40 differents pages). I need to convert each page to a view in my iPhone/Android app (probably made in JS+HTML with PhoneGap). So I guess I'll have to create an API and separate the model/controller/view on each page.

I don't know how to manage the connection, but I'm sure I'm doing it in a bad way (see code below).

My controller looks like this:

&lt;?php
// Database connection, get $_GET("page") ...
if (file_exists($page)) {
    if(isMemberRestricted($page)) {
    $loadUserInf = TRUE;
        if(!isValid($_SESSION['usern'], $_SESSION['passw'], $db)) {
            if(!isValid($_COOKIE['cookie_password'] , $_COOKIE['cookie_password'], $db)) {
                if(!isValid($_POST['usern'], $_POST['passw'], $db)) {
                       if(isValid($_POST['usern'], $_POST['passw'], $dbt)) {
                          $page = CONTROLLER_PATH . "/desarchivage.php";
                       }
                       else {
                         $page = CONTROLLER_PATH . "/notConnected.php";
                       }
                       $loadUserInf = FALSE;
                 }         
            }
        }
        else { // not yet connected 
            if($loadUserInf) // but connexion accepted
                connexion ();
        }
    }
    if($loadUserInf) {
        require ('userInf.php'); // Loads informations about the connected user
        pageRoutine(); // Stuff to do on each member restricted page
    }
} else {
   $page = CONTROLLER_PATH . "/404.php";
}

require ($header);
require ($page);
require ($footer);
?&gt;


I really don't know where to start. I've read about MVC/API.  I understood the theory, but I don't know where to begin with an existing project.
The first 'problem' I notice is what I call a roocky mistake (been there, done that) is the way you route a request.

If a person requests ?page=mypage.php you check or that file exists if so, you include it.
this means that your filesystem is hardcoded with your routing. Everytime you change a file-name, your routes also change. Also, some file-systems are case-sensitive (oh oh!)

A better would be to have a Router script that handles routing, it recieves a request, and it simply calls the correct method. Routes can be stored in a database table, local file or even written in PHP (as in laravel)

Another thing that really bugs me is all the $_ variables in your code. A better thing to do is to wrap them somehow (e.g. a Class or a set of functions). These functions would then have some validation in them. E.g. CSRF protection when _POST data is given, or instead of using the default php session handler, have your own that stores all session data in a database, ...

You talk about MVC and that your php files are always a Model, controller and view in one. So you didn't use MVC, you simply started coding everything together. And that is simply not how you should begin.

When designing an API, make your own (web)-inteface use the same API as your smartphone-apps. This way, you only have to work on one single API instead of having an API for apps and a completly different one for the web.