My colleague Brent offers some more details on the intricacies of Laravel's query builder.
I recently learned that not all query builder functionality in Laravel is "safe". This means that user input shouldn't be passed directly to it, as it might expose your application to SQL injection vulnerabilities.
Read more [stitcher.io]
Our laravel-query-builder package exposed a serious security issue: it allowed SQL injection attacks. Laravel Query Builder v1.17.1, which is now available, fixes the vulnerability. If you're using the package, stop reading now and upgrade to the latest version first. For Laravel 5.6, 5.7 and 5.8…
Join 9,500+ smart developers
Get my monthly newsletter with what I learn from running Spatie, building Oh Dear, and maintaining 300+ open source packages. Practical takes on Laravel, PHP, and AI that you can actually use.
No spam. Unsubscribe anytime. You can also follow me on X.
"If you are one of the *millions* who have downloaded a Spatie package, then you understand the quality that Freek aims for. The newsletter is of the same quality of any Spatie package you're using."
A short and sweet article by my colleague Seb.
I was always adding features because I’d expect other people to expect them. It’s a trap! You’re not making people happier by guessing what they might need. You’re not doing anyone a disservice by building things for yourself.
Read more [sebastiandedeyne.com]
On the Oh Dear! blog, Mattias Geniar explains how you can use our service to keep your Varnish cache warm.
Slow websites are annoying, right? We sure think so. One common solution is to introduce a caching proxy like Varnish to help cache pages and reduce your server load. The good news is, if you have Oh Dear!, you can let those 2 work together.
Read more [ohdear.app]
Laravel event projector is a package that aims to be the entry point for event sourcing in Laravel. It can help you setting up aggregates, projectors and reactors. Earlier today our team released v2. This version streamlines the projectors and reactors from v1 and adds support for aggregates.
In this blogpost I'd like to explain a potential problem with traditionally built applications. After that we'll take a look at what projectors and aggregates are. Finally we'll walk through an example how you can create an aggregate laravel-event-projector.
It's a minor thing but PHP's `isset` can accept multiple vars which will allow you to simplify your code. ? pic.twitter.com/GBgYEDSOya
— Eric L. Barnes (@ericlbarnes) April 4, 2019
Read more [twitter.com]
Mattias Geniar argues that you shouldn't buy extended validation certificates.
You know those certificates you paid 5x more for than a normal one? The ones that are supposed to give you a green address bar with your company name imprinted on it? It's been mentioned before, but my take is the same: they're dead.
Read more [ma.ttias.be]
Sebastian wrote a short post on how to configure Husky to run Prettier on every commit.
I'm a happy prettier user to keep my CSS and JavaScript files consistent. However, it's hard to keep the discipline to run Prettier before every commit. This week I decided to automate the process with Husky and lint-staged.
Read more [sebastiandedeyne.com]
KH. Jebran Ali lists a few cool Laravel tricks
Laravel is full of hidden gems that I have discovered during working on different tasks. Some of these gems were less-known or un-documented features, functions parameters and hacks. In this blog post I will share those hidden gems with you, let’s get started.
Read more [meramustaqbil.com]
Kent C. Dodds guides us through creating our first function on Netlify.
Luckily for us, almost exactly one year ago from the time I'm writing this, Netlify took the complexity of AWS Lambda functions and made it super simple.
Read more [kentcdodds.com]
PHP UK is one of my favourite conferences. Unfortunately I couldn't make it this year, but I'll be sure to watch the videos that have been published a little while ago.
Here's a cool session on running PHP on AWS Lamba by Neal Brooks
You can watch all other talks in this playlist on YouTube.
React lead dev Dan Abramov makes the case for naming your ideas and projects.
The problem it’s solving might be so ingrained that we don’t even notice it. It’s the elephant in the room. And we can’t discuss what we never named.
Read more [overreacted.io]
? Here's an undocumented hidden @laravelphp gem. Did you know you there's a shorter way to retrieve models in a chunked way? ?https://t.co/Vj74GAfAAr#laravel #php pic.twitter.com/qcVr5bCqGZ
— Freek Van der Herten ? (@freekmurze) March 25, 2019
Read more [twitter.com]
Matt Allan took a deep dive learning about environment variables.
Laravel, Symfony, and other modern PHP frameworks use environment variables to store security credentials and configuration that changes from one machine to the next. ... Let’s break down what environment variables are, how they work, and how to correctly use them in your code.
Read more [mattallan.me]
How to test something you are pulling OUT of Storage.
— Jake Bennett (@JacobBennett) March 19, 2019
Typically Laravel Storage testing is comprised of asserting that you put something IN Storage. If you happen to be pulling something down from a Storage disk and doing some processing on it, this has been helpful. pic.twitter.com/VjSqo914US
Read more [twitter.com]
Anna Filina explains the handy platform option you can use in composer.json. It's a good idea to just use this in all of your projects.
Say you run the latest PHP version on your machine, but the server runs PHP 5.5. This means that when you decide to add a Composer package, it might propose a version that may not be installable on the server. The solution is surprisingly easy. You can instruct Composer to see the PHP version of your choosing.
Read more [afilina.com]
A while ago Povilas Korop, creator of and writer at LaravelDaily, shared some interesting numbers on his blog.
Over at the Tighten blog, Chris Trombley published a new post on how to use data providers in PHPUnit.
PHPUnit gives us a way to consolidate this common logic while varying our setup data, without losing the benefit of dedicated, smaller test methods. In this post, we'll explore PHPUnit's data providers. While data providers are available in any PHPUnit test suite, let's look at how they can help us tidy up our tests in a Laravel application.
Read more [tighten.co]
I fully agree with Troy Hunt here.
So in summary, everyone clicks through cookie warnings anyway, if you read them you either can't understand what they're saying or the configuration of privacy settings is a nightmare, depending on where you are in the world you either don't get privacy or you don't get UX hell, if you understand the privacy risks then it's easy to open links incognito or use an ad blocker, you can still be tracked anyway and finally, the whole thing is just conditioning people to make bad security choices.
Read more [www.troyhunt.com]
Jonathan Reinink is creating a library that'll make it easy to create server-driven single-page apps. Super cool idea!
I wanted to blend the best parts of classic server-side apps (routing, controllers, and ORM database access) with the best parts of single-page apps (JavaScript rendering and no full page reloads). Or, at least the best parts as I see them. ?
That journey has led me to a pretty interesting new pattern, which this article explains in detail. In short, I've created a Turbolinks inspired library that makes it super easy to create server-driven single-page apps. I am calling this library Inertia.js.
Read more [reinink.ca]
