title: Strategies for implementing a REST like API in an existing web-application
body: <p>Currently we have a lot of web pages that either have SQL statements embedded in them or call a specific php script that does a specific job - ie getNames.php - as part of a ajax call back. Neither are particularly maintainable.</p>
  
  <p>I was thinking about using a REST like API to get the necessary data to the client and then munge the data into something usable. This is attractive as this lessens the burden on maintaining highly complex sql in code and allows centralisation of data (so just one AJAX call to get the data not lots of little ones). Also allows the database to change lessening the impact on the client.</p>
  
  <p>However there are two problems I can see with this strategy: </p>
  
  <ol>
  <li>The site is a game, and so I need the RESTlike API to be protected from abuse/cheating as much as possible. </li>
  <li>All examples of REST API's use a controller to handle the requests in root. That's not ideal for me since we are at //company/games/game/ and there already is an index.php at root (//company/).</li>
  </ol>
  
  <p>What options and strategies do I have for the two constraints I listed?</p>