Freek.dev

Jordi Boggiano, the creator and maintainer of Composer and Packagist, released some fresh statistics on which PHP version composer users are running.

A few observations: 5.3 dropped to almost nothing which is great news! 5.4 is also down by almost 10% and is definitely on the way out. 5.5 is still big but less so, while 5.6 got a huge boost to become the main version. The big surprise is that we have 20% of PHP7 already! That is great news only six months after this major release came out.

20% sounds really great, but I suspect that this number is slightly optimistic. Many developers who are running PHP 7 in their dev environment use PHP 5.X in production.

Over on the package side only ±20% of all packages require PHP 5.5 or above and only 1% requires PHP 7. Jordi has this to say about that:

All in all, it seems like package requires are way behind actual version usage, so I would like to encourage everyone to be a bit more aggressive in bumping PHP requirements when tagging new major releases of their libs.

That's great advice. The bulk of the newly released Spatie packages require PHP 7. In my opinion you'd do our ecosystem a favour by picking PHP 7 as a minimum requirement when you are creating a new package.

Read Jordi's entire post on his blog for more details: https://seld.be/notes/php-versions-stats-2016-1-edition

Read more

Matt Stauffer has been working on a book titled "Laravel: Up and Running" which will be released soon. In a post on his blog Matt shares a few hidden Laravel gems that he discovered while writing his book.

No blog post could contain all of the new things I learned from writing this book. I've been using—and teaching about—Laravel for years, and I was still shocked by how many tools and helpers and features I discovered.

Here are a few that stand out to me that I had never seen prior to writing the book.

https://mattstauffer.co/blog/things-i-didnt-know-laravel-could-do

Read more

Phil Sturgeon provides a good explanation on the why and how of middlewares in PHP.

Recently there has been a lot of buzz about HTTP middleware in PHP. Since PSR-7 was accepted, everyone and their friend Sherly has been knocking out middleware implementations, some of them stunning, some of them half-arsed, and some of them rolled into existing frameworks. HTTP Middleware is a wonderful thing, but the PHP-FIG is working on a specific standard for middleware, which will standardise this mess of implementations, but some folks don't seem to think that would be useful.

Let's look into middleware a little closer, to show you why it's something to smile about.

https://philsturgeon.uk/2016/05/31/why-care-about-php-middleware/

Read more

Sebastian De Deyne, developer at Spatie and creator of several Spatie packages, has written a post on how to override Laravel's default translation provider.

When building a website for a client that wants to be able to manage content, Laravel's language files aren't ideal since you can't edit them without diving into a bundle of text files. We recently decided to drop all the lang files in our custom CMS in favor of persisting translations in the database, which allows us to build a custom interface for managing them.

This post is a quick overview on overwriting Laravel's default translation loader, which means you can keep using the lang method while fetching the translations from a database. Writing a custom loader is easier than it sounds. First we'll set up our translation models, then we'll write our loader, and finally register it in our application.

https://sebastiandedeyne.com/posts/2016/using-a-database-for-localization-in-laravel

Seb implemented the described functionality in Blender, our Laravel template we use to kickstart nearly all our projects.

Read more

Some great coding tips written down by Joeri Timmermans on the Intracto blog.

As a developer it's your duty to take good care of your code. It's not enough for your code to work, you also have to make sure it's well written and readable. If we spend 10 times more time reading code versus actually writing it, this means the readability of your code is directly related to your output and the output of your co-workers. So providing cheaper reads will not only create happier co-workers, but also increase the productivity of your whole team.

http://blog.intracto.com/how-to-save-a-kitten-by-writing-clean-code

Read more

Frank de Jonge wrote an article on how to structure to your functions to avoid the duplication of cleanup code. Spoiler: use finally.

Cleaning up after yourself can be a tedious task. For example, closing file handlers after using them needs to be done. A programmer's life isn't all about the happy path. When things go pear-shaped you might end up duplicating cleanup code throughout your code. This is horrible, let's explore an alternative.

https://blog.frankdejonge.nl/finally-file-streams-and-deferred-execution-in-php/

That defer keyword from Go looks super nice.

Read more

Over at Sitepoint Christoper Pitt shares some research he has done in finding differences in images using PHP.

I recently stumbled across a fascinating question: how could I tell whether an image had changed significantly? As PHP developers, the most troublesome image problem we have to deal with is how to resize an upload with an acceptable loss of quality.

In the end I discovered what many before me have – that this problem becomes relatively simple given the application of some fundamental mathematical principles. Come along with me as we learn about them…

https://www.sitepoint.com/finding-differences-in-images-with-php

Read more

Mark Baker made some fascinating benchmarks on the performance of PHP 7's anonymous classes.

A week or so ago, I published an article entitled “In Search of an Anonymous Class Factory” about my efforts at writing a “factory” for PHP7’s new Anonymous Classes (extending a named concrete base class, and assigning Traits to it dynamically); and about how I subsequently discovered the expensive memory demands of my original factory code, and then rewrote it using a different and (hopefully) more memory-efficient approach.

Since then, I’ve run some tests for memory usage and timings to assess just how inefficient my first attempt at the factory code was, and whether the new version of the factory really was better than the original.

Read more

Over at the CloudFlare blog John Graham-Cumming wrote an interesting article on SQL injection attacks via http request headers.

SQL injection is a perennial favorite of attackers and can happen anywhere input controlled by an attacker is processed by a web application. It's easy to imagine how an attacker might manipulate a web form or a URI, but even HTTP request headers are vulnerable. Literally any input the web browser sends to a web application should be considered hostile.

Read more

Jeremy Kendall dissects bad PHP code on his site csiphp.com.

It all began with a new gig and an amazingly horrific codebase. I began tweeting the most unbelievable, most frustrating snippets I could find. After quite a few of those tweets, Chris Hartjes replied with, “Looking at your tweets I cannot even fathom what your job is. CSI:PHP?” A concept was born.

Twitter’s 140 characters are rarely enough to share the horrors of bad code, and I don’t want to give short shrift to the nefarious and misguided scripts that I’ve found. Behold the CSI: PHP blog, where I investigate criminally bad codebases and share the evidence with you, my fellow developers.

Read more

The Query Tracer package can help you find out where a specific database query is being called. It works with both Clockwork and the Laravel Debugbar. Here's a screenshot taken from the readme:

https://github.com/fitztrev/query-tracer

EDIT: turns out that Laravel Debugbar can do this out of the box:

https://twitter.com/barryvdh/status/732570607058046977

Read more

Amo Chohan wrote a rundown of the big changes coming tot PHP 7.1

• Catching multiple exception types
• Curl HTTP/2 server push support
• Support class constant visibility
• Void return types
• Generalize support of negative string offsets
• Allow specifying keys in list() and square bracket syntax for array destructuring
• Warn about invalid strings in arithmetic
• Deprecate and remove mcrypt()

Read more

On dotdev.co Eric L. Barnes explains a new feature that is coming in PHP 7.1

With the accepted proposal it creates an alternative to using “list” for destructuring an array. In all previous versions of PHP this works like this: list($a, $b, $c) = array(1, 2, 3); Now you can extract using a square bracket just as you do for assignment: [$a, $b, $c] = [1, 2, 3]; ["a" => $a, "b" => $b] = ["a" => a, "b", => 2];

Read more

Here is one performance setting in your PHP configuration you probably haven't thought about much before: How often does PHP perform random garbage collection of outdated session data in your application? Did you know that because of the shared nothing architecture PHP randomly cleans old session data whenever session_start() is called? An operation that is not necessarily cheap.

Read more