Page 30 - PHP

Xdebug only works reliably in Docker containers once you understand the three most common pitfalls: incorrect host detection, missing path mapping, and Xdebug overhead during normal operation. Solve these three issues properly once, and debugging in Docker becomes just as comfortable as debugging locally.

An ordinary array used as a cache with objects as keys or values prevents those objects from ever being collected by the garbage collector as long as the cache itself exists, and that is exactly what leads to creeping memory leaks in long running processes. WeakMap solves this problem structurally by removing the cache's own influence on the lifetime of the referenced objects.

Psalm vs. PHPStan is rarely a question of right or wrong, but of priorities: taint analysis and aggressive type narrowing speak for Psalm, a larger plugin ecosystem and mature generics support speak for PHPStan. This article compares both tools technically and provides a practical decision framework for teams.

Many PHP developers reach for the @ operator as a convenient way to silence annoying warnings from file operations or network calls. In reality it is one of the language's most dangerous tools, because it suppresses not just the expected failure but every failure at that point, without logging and without any distinction. This article shows what the operator actually does under the hood, where it leads to silent bugs, and which concrete alternatives deliver robust error handling instead.

Three tests that check the same thing with only different input values are not a sign of good test coverage. They are technical debt. DataProvider solves this problem elegantly: one test method, many datasets, each one a separate, named test case. Used correctly, DataProvider reduces duplication and increases readability at the same time.

Enforcing PSR-12 without blocking every pull request with comments about indentation and brace placement requires automation instead of good intentions. PHP_CodeSniffer and PHP-CS-Fixer, combined with pre-commit hooks and a CI pipeline, permanently end formatting discussions in review, even in grown legacy projects.

A regular expression that matches short test inputs in milliseconds can suddenly take seconds or minutes on a only slightly longer, maliciously crafted input, because the PCRE engine tries exponentially many backtracking points. This phenomenon, known as catastrophic backtracking, is one of the most underestimated performance and security pitfalls in PHP applications that validate user input against regex patterns. This article shows how backtracking works mechanically, which pattern structures cause it to explode, and which concrete techniques systematically defuse the risk.

Anyone who checks user input only against known attack patterns inevitably misses the next variant. This article explains why allowlist validation beats every blocklist, how to correctly use PHP's filter_var function, which pitfalls Magento's form validation holds, and why validation and sanitization are strictly separate tasks with different goals.

Memoization stores the result of a function on its first call and returns it instantly from cache on every further call with the same arguments. Because this technique is only guaranteed correct for referentially transparent, pure functions, memoization directly connects functional programming and performance optimization in PHP 8.4.

Anyone who treats the match expression and switch as interchangeable overlooks solid differences: match compares strictly with ===, has no fallthrough, and throws an UnhandledMatchError on an unhandled case, while switch compares loosely with == and simply does nothing without a match. This article uses PHP 8.4 code examples to show when the match expression is the more robust choice and where switch still has its place.