best practices

All my posts about best practices.

Join 9,500+ smart developers

Get my monthly newsletter with what I learn from running Spatie, building Oh Dear, and maintaining 300+ open source packages. Practical takes on Laravel, PHP, and AI that you can actually use.

No spam. Unsubscribe anytime. You can also follow me on X.

Unsafe SQL functions in Laravel

stitcher.io

My colleague Brent offers some more details on the intricacies of Laravel's query builder.

I recently learned that not all query builder functionality in Laravel is "safe". This means that user input shouldn't be passed directly to it, as it might expose your application to SQL injection vulnerabilities.

Read more [stitcher.io]

20 unknown gems of Laravel

meramustaqbil.com

KH. Jebran Ali lists a few cool Laravel tricks

Laravel is full of hidden gems that I have discovered during working on different tasks. Some of these gems were less-known or un-documented features, functions parameters and hacks. In this blog post I will share those hidden gems with you, let’s get started.

Read more [meramustaqbil.com]

Fake PHP version in composer

afilina.com

Anna Filina explains the handy platform option you can use in composer.json. It's a good idea to just use this in all of your projects.

Say you run the latest PHP version on your machine, but the server runs PHP 5.5. This means that when you decide to add a Composer package, it might propose a version that may not be installable on the server. The solution is surprisingly easy. You can instruct Composer to see the PHP version of your choosing.

Read more [afilina.com]

Strategies for dealing with environment variables

marijn.huizendveld.com

Here's an interesting approach to work with env variables proposed by Marijn Huizendveld

Frameworks offer tools to parameterize environments in a variety of ways. But because of this configuration files of projects tend to get messy once projects are taken into production. Specifying purpose of the parameter within the name can help identify unneeded configurations. Making configuration explicit within the application layer can be even more helpful. Doing so eases refactoring and provides potential to improve the overall developer experience.

Read more [marijn.huizendveld.com]

Hand-written service containers

matthiasnoback.nl

Matthias Noback makes the case for writting your own service containers.

Dependency injection is very important. Dependency injection containers are too. The trouble is with the tools, that let us define services in a meta-language, and rely on conventions to work well. This extra layer requires the "ambient information" Paul speaks about in his tweet, and easily lets us make mistakes that we wouldn't make if we'd just write out the code for instantiating our services.

Read more [matthiasnoback.nl]

Q&A on the Book Refactoring - Second Edition

www.infoq.com

Refactoring is an excellent book written by Martin Fowler. He recently released a second edition. I'm reading it now and can recommend it to anyone interested in writing better code. Here's an interview with the author on the second edition of the book.

InfoQ interviewed Fowler about the major changes in the 2nd edition of Refactoring, how to recognize code smells and refactor code, how code reviews and refactoring support each other, what tech leads can do to encourage refactoring, the benefits refactoring brings, using tools for refactoring, and mob programming.

Read more [www.infoq.com]

A better way to register routes in Laravel original

by Freek Van der Herten – 3 minute read

Let's take a look at how you can define routes to controllers in Laravel. By default you can do it like this: Route::get('my-route', 'MyController@index'); This will look for the MyController class in the App\Http\Controllers namespace. This default namespace is set up in Laravel's…

Read more

Are you sure you need entrust or laravel-permission to implement your authorization?

adelf.pro

Some solid advice from Adel Faiz: do not use a package for authorization unless you really need its functionalities. Laravel's default authorization capabilities are good enough for most use cases.

I don't want to say these packages are useless. They can be useful for projects which needs complicated authorization system, which should be customizable by customer later. Also some projects need dynamic permissions. For all other projects it's too heavy solution. Better to use simple code-based authorization.

Read more [adelf.pro]

Extended Validation Certificates are Dead

www.troyhunt.com

In a new blogpost Troy Hunt explains why you shouldn't bother buying an EV certificate anymore.

That's it - I'm calling it - extended validation certificates are dead. Sure, you can still buy them (and there are companies out there that would just love to sell them to you!), but their usefulness has now descended from "barely there" to "as good as non-existent". This change has come via a combination of factors including increasing use of mobile devices, removal of the EV visual indicator by browser vendors and as of today, removal from Safari on iOS

Read more [www.troyhunt.com]

Test Contra-variance

blog.cleancoder.com

In an older but still relevant article on the Clean Coder Blog, Uncle Bob argues that the structure of your tests should not necessarly reflect the structure of your code.

The structure of the tests must not reflect the structure of the production code, because that much coupling makes the system fragile and obstructs refactoring. Rather, the structure of the tests must be independently designed so as to minimize the coupling to the production code.

Read more [blog.cleancoder.com]