Framework Rule Set

JavaScript events must never be listened to via a class or id. These are visual / stylistic identities. All JS interactions are managed with the data-js attribute. When CSS removes a class, JavaScript never breaks.

<!-- HTML -->
<button id="submitBtn" class="btn">Gönder</button>

// JavaScript
document.getElementById('submitBtn')
  .addEventListener('click', ...)

<!-- HTML -->
<button class="btn btn-primary" data-js="login-submit">Gönder</button>

// JavaScript
document.querySelector('[data-js="login-submit"]')
  .addEventListener('click', ...)

Dark/Light mode and themes are managed via the data-theme and data-mode attributes of the <html> tag. body classes are not used.

<!-- HTML -->
<html lang="tr" data-theme="default" data-mode="light">

/* app.css */
html[data-theme="default"][data-mode="dark"] {
    --bg-color: #0b0c0e;
    --text-main: #ffffff;
}
html[data-theme="default"][data-mode="light"] {
    --bg-color: #ffffff;
    --text-main: #111111;
}

Every data coming from the database is wrapped with ViewMethod display() before being printed to the DOM. Every data coming to the API is cleaned with SystemMethod functions like stripHtml() or sanitizeInt() before being processed.

The APP_ENV value in the .env file determines error visibility (1 = Debug, 0 = Production). In a production environment, PHP stack traces or raw error messages are never shown to the end user.

define('APP_ENV', (int)$_ENV['APP_ENV']);

if (APP_ENV === 1) {
    ini_set('display_errors', 1);
    error_reporting(E_ALL);
} else {
    ini_set('display_errors', 0);
}