Page 11 - PHP

PHP serialization decides more than just the data format: serialize() is fast and preserves every object property, but quickly becomes an entry point for object injection with untrusted data. JSON is safe and language independent, at the cost of object fidelity and some speed. This article shows how both formats work internally, where unserialize() turns dangerous, and how a clean migration in existing systems succeeds.

HATEOAS turns a PHP API into a real state machine: instead of clients building URLs themselves, every response ships the links that are actually allowed in the current state. This article shows a practical HATEOAS implementation in PHP with the HAL format, a custom link builder, and concrete examples from an order process.

A single model that both enforces complex business rules on writes and delivers fast, denormalized views for the UI almost always forces lazy compromises on both sides. CQRS resolves that tension by consistently separating commands that change state from queries that only read, each with its own model tailored to its purpose.

PHP-FPM processes requests synchronously and blocking, a model that is well proven for classic web applications but reaches its limits with WebSockets, queue workers and heavy I/O load. Asynchronous PHP with Swoole or ReactPHP uses event loops and coroutines to manage thousands of concurrent connections in a single process, without ever leaving the PHP language.

PHPUnit 11 is not an incremental update. It removes docblock annotations in favor of native PHP attributes, tightens coverage configuration, fundamentally changes the mock system, and sets PHP 8.1 as the minimum requirement. Anyone migrating has to change more than just the version number in composer.json.

Behind every require-free PHP project sits a simple, but often misunderstood mechanism: Composer autoloading translates namespace declarations from composer.json, through generated PHP files and a longest-prefix-match algorithm, into actual file paths. This article opens the black box: from composer dump-autoload through autoload_psr4.php to the ClassLoader::loadClass() method, step by step, with real, traceable code for PHP 8.4.

80% line coverage sounds good. But line coverage says nothing about whether the right cases are being tested. A branch that gets executed for one particular input counts as covered, no matter whether the other branch is ever tested. Coverage is a tool, not a goal. Anyone who treats it as a vanity metric ends up optimizing the number instead of the quality.

Anyone who writes tests without a clear pattern ends up with a test suite that is slow, brittle and hard to understand. Data providers, meaningful assertions, isolated mocks and a sensible coverage strategy separate tests that immediately catch a refactoring mistake from green tests that stay green despite bugs.

Mutable objects are one of the most common sources of hard-to-trace bugs: a value changes somewhere in the call graph, and nobody quite remembers where. Readonly Properties move this guarantee from convention to the language level, for individual properties since PHP 8.1, for entire classes since PHP 8.3, turning immutability into a property the interpreter itself enforces instead of merely documenting.

Slow catalogs almost never result from too little hardware, but from queries without a matching index, unnecessarily wide SELECT statements and missing caching. This article shows how to read EXPLAIN plans, diagnose missing indexes, reduce connection overhead and configure MySQL/MariaDB for catalog-heavy PHP applications.