DEV Community

Cover image for I Almost Lost Commerza: The Brutal Reality of Building an Ecommerce System Without a Framework

I Almost Lost Commerza: The Brutal Reality of Building an Ecommerce System Without a Framework

Syed Ahmer Shah on April 19, 2026

I am 19 years old. I set out to build a production-grade e-commerce system from scratch. No Laravel. No React. Just raw PHP, MySQL, and a lot of st...
Collapse
 
faique_26 profile image
Faique

Learning the importance of version control the hard way is a rite of passage for almost every developer. Relying on AI tools like Copilot is great for velocity, but as you experienced, it absolutely cannot replace the safety net that a proper Git workflow provides. Glad you were able to recover and rebuild the system even stronger than before.

Collapse
 
syedahmershah profile image
Syed Ahmer Shah

"A rite of passage" is the perfect way to describe it. It’s a painful lesson, but I can guarantee I’ll never start another project without git init ever again. Losing 40% of your work in a split second changes how you look at the "Save" button forever.

Collapse
 
automate-archit profile image
Archit Mittal

The "no framework" war stories are always educational. The thing that usually bites teams later isn't the initial framework-free velocity — it's idempotency on payments, race conditions on inventory decrement, and the migration tooling that frameworks quietly solve. I'd love to hear which of those hit you hardest. Any chance you ended up re-implementing a mini-framework internally by the end (routing layer, ORM-ish abstraction, migration runner)?

Collapse
 
syedahmershah profile image
Syed Ahmer Shah

To avoid those exact traps, I actually ended up building what feels like a 'security-first mini-framework' from scratch.

To handle inventory and payments, I implemented strict SQL row-locking (FOR UPDATE) and transactional idempotency. For the 'mini-framework' layers:

Routing: Custom clean-route layer with .htaccess orchestration.

Security: Layered hashing (Argon2id with bcrypt fallback), CSP with 128-bit nonces that refresh on every request, and XSS protection built into the core engine.

Anti-Abuse: A hybrid CAPTCHA (reCAPTCHA v3 + v2 fallback) combined with a custom-built challenge and mandatory 6-digit email OTPs for high-value actions.

DevOps: I built PowerShell-based migration scripts and CI/CD pipelines for smoke testing to replace what a framework usually handles.

The hardest part wasn't the code—it was ensuring that every alert, SMTP status change, and security log was intentional. It’s framework-less, but definitely not 'structure-less.'

Collapse
 
farzeendev profile image
Sagar Kumar

This is a great reminder that AI tools can break production code fast. Solid insights on version control, security, and scalable ecommerce backend design.

Collapse
 
syedahmershah profile image
Syed Ahmer Shah

It’s a scary realization how fast a tool meant to help can turn into a "delete" button. The lesson for me was that AI is a great assistant for writing a function, but a terrible partner for restructuring an entire system.

Collapse
 
itskondrat profile image
Mykola Kondratiuk

pushing back slightly - the lesson is not "no frameworks = real engineer." AI generates plausible code but has no model of your system constraints. that gap bites with or without a framework.

Collapse
 
syedahmershah profile image
Syed Ahmer Shah

I Agree with you that the lesson is about technical intentionality, not just 'No Frameworks but the reason I chose to build framework-less is that frameworks provide a layer of abstraction that often masks those system constraints. When an AI generates a 'plausible' controller in Laravel, it’s easy to overlook the underlying race conditions or session vulnerabilities because the framework handles the heavy lifting.

By removing the framework, I forced the 'system constraints' to the surface. I had to manually architect the row-locking, the CSP nonce lifecycle, and the idempotency logic. That process bridged the gap between 'plausible code' and 'predictable systems' in a way that wouldn't have happened if I were just filling in framework boilerplate. It wasn't about being a 'real engineer'; it was about becoming the person who actually understands why the constraints exist in the first place."

Collapse
 
itskondrat profile image
Mykola Kondratiuk

right - that's what ai exploits. it writes confident laravel controllers because the pattern is in training data, not because it understood your constraints. going raw forces the modeling step.

Collapse
 
farzeenai profile image
Aley

Brutally honest story of building an ecommerce system without frameworks. Great insights on AI risks, backend architecture, Git mistakes, and real-world security lessons.

Collapse
 
syedahmershah profile image
Syed Ahmer Shah

"Brutally honest" was the only way to write this. I think it’s important to share the failures, not just the finished products, especially with how much "perfect" AI-generated code we see online these days.

Collapse
 
farzeenshahofficial profile image
Zohaib

Raw 🔥

Collapse
 
syedahmershah profile image
Syed Ahmer Shah

Thanks for the energy! It was a fiery process to get through, but the system is much stronger because of it.

Collapse
 
syedfarzeenshahofficial profile image
Vinod Oad

Great real world lesson on building an ecommerce system without frameworks. The Git mistake and AI refactor issue highlight why version control and architecture matter in scalable backend development.

Collapse
 
syedahmershah profile image
Syed Ahmer Shah

Exactly. Building without a framework is like taking the covers off the engine while it's running—it's messy and dangerous, but you finally see how the pistons move. Architecture isn't just about clean folders; it's about making sure those 238 files actually talk to each other without collapsing.

Collapse
 
syedfarzeen profile image
Ganjkar Bhai

Kudos 🎉

Collapse
 
syedahmershah profile image
Syed Ahmer Shah

Appreciate the kudos! It’s been a wild ride, and I’m just glad the project survived the "AI butchery" phase.