Scaffolding Yii CRUD with Gii: From Setup to Customization

When a new database table is added to a Yii application, the fastest way to get a working admin interface is to let the framework generate the boilerplate code. Yii’s built‑in Gii module can create models, controllers and views in seconds, but the output is meant as a starting point, not a final product.

Enabling and Securing Gii

Add the Gii module to the web configuration (config/web.php) and limit access to trusted IP addresses. Leaving Gii open to the internet exposes source code and allows arbitrary code execution.

return [
    'modules' => [
        'gii' => [
            'class' => \yii\gii\Module::class,
            'allowedIPs' => ['127.0.0.1', '::1', 'YOUR_IP_ADDRESS'],
        ],
    ],
];

After saving the file, reload the application and visit http://your-host/gii. You should see the Gii welcome screen if your IP matches the list.
Generating CRUD for a Table
Assume a migration has already created a table named post with columns id, title, content and created_at. In the Gii interface choose the “CRUD Generator”.

Set Table Name to post.
Set Model Class to app\models\Post (or let Gii suggest it).
Set Controller Class to app\controllers\PostController.
Click “Preview” to see the files that will be created, then “Generate”.

Gii writes the following files (paths relative to the project root):

models/Post.php
controllers/PostController.php
views/post/index.php, create.php, update.php, view.php, _form.php

The generated model extends yii\db\ActiveRecord and contains basic validation rules:
namespace app\models;

use yii\db\ActiveRecord;

class Post extends ActiveRecord
{
    public static function tableName()
    {
        return '{{%post}}';
    }

    public function rules()
    {
        return [
            [['title', 'content'], 'required'],
            [['content'], 'string'],
            [['title'], 'string', 'max' => 255],
        ];
    }
}

The controller includes the standard actions:
namespace app\controllers;

use Yii;
use app\models\Post;
use yii\web\Controller;

class PostController extends Controller
{
    public function actionIndex()
    {
        $dataProvider = new \yii\data\ActiveDataProvider([
            'query' => Post::find(),
        ]);

        return $this->render('index', [
            'dataProvider' => $dataProvider,
        ]);
    }

    public function actionCreate()
    {
        $model = new Post();

        if ($model->load(Yii::$app->request->post()) && $model->save()) {
            return $this->redirect(['view', 'id' => $model->id]);
        }

        return $this->render('create', [
            'model' => $model,
        ]);
    }

    // view, update, delete actions omitted for brevity
}

The view files use Yii widgets such as ActiveForm and GridView:
/* views/post/_form.php */
use yii\widgets\ActiveForm;
use yii\helpers\Html;

$form = ActiveForm::begin([
    'options' => ['enctype' => 'multipart/form-data'],
]);

echo $form->field($model, 'title')->textInput(['maxlength' => true]);

echo $form->field($model, 'content')->textarea(['rows' => 6]);

echo Html::submitButton($model->isNewRecord ? 'Create' : 'Update', ['class' => $model->isNewRecord ? 'btn btn-success' : 'btn btn-primary']);
ActiveForm::end();

Customizing Generated Code
The scaffolding gives you a functional CRUD interface, but production code usually needs additional work:

Business logic – move complex calculations into model methods or service classes.
Validation – add custom rules, dependent validation, or scenario‑based rules.
Access control – attach a filter or use Yii’s RBAC to restrict who can create, update or delete records.
UI polishing – replace the default GridView columns with formatted data, add date pickers, or integrate a frontend framework.
Security – ensure that user‑input is properly escaped, consider using HtmlPurifier for rich text, and verify that file uploads (if added) are validated.

For example, to add a rule that the title must be unique, edit the model’s rules() method:
public function rules()
{
    return [
        [['title', 'content'], 'required'],
        [['content'], 'string'],
        [['title'], 'string', 'max' => 255],
        [['title'], 'unique', 'targetAttribute' => 'title', 'message' => 'This title has already been taken.'],
    ];
}

After making changes, clear the application cache (php yii cache/flush) and test the updated pages.
Limitations and Next Steps
While Gii accelerates prototyping, the generated code is not a substitute for a thoughtful design. Treat the output as a draft:

Review each file for adherence to your project’s coding standards.
Extract repeated view fragments into reusable widgets or layout files.
Replace the default ActiveRecord‑centric controller with a service layer if your application grows.
Remember that Gii should never be left enabled on a public server; remove the module or tighten allowedIPs before deploying to production.

When you have completed the customization, run your automated test suite (if you have one) or manually verify the index, create, update and delete flows. If everything works as expected, you have turned Gii’s scaffolding into a solid foundation for your feature.