Tag: PHP

1. PHP Session Security: Preventing Fixation and Hijacking

   Jan 14, 2026

   A hijacked session gives an attacker the same access as a stolen password, often without the actual login mechanism ever being compromised. Solid session security in PHP combines ID regeneration after login, secure cookie flags and server side binding to stable client traits to prevent both fixation and hijacking alike.

   Read more

2. Rate Limiting from Scratch: Token Bucket & Sliding Window in PHP

   Jan 8, 2026

   Without rate limiting, a single misbehaving client loop or a targeted attack is enough to bring a PHP API to its knees. Building your own rate limiting is straightforward with Redis and a few lines of PHP, with no third party gateway required, and the choice between fixed window, sliding window and token bucket determines how fair and how burst tolerant the protection actually turns out to be.

   Read more

3. Performance Profiling with Blackfire and XHProf: Finding Bottlenecks

   Dec 27, 2025

   Anyone who hunts performance problems in PHP applications only through gut feeling and spot-checks in production wastes time on the wrong places. Blackfire and XHProf deliver reliable callgraphs, separate exclusive and inclusive times, as well as standalone wall time, CPU time, and I/O wait metrics, letting you clearly distinguish real bottlenecks from harmless symptoms, whether in a monolith, a microservice, or a CLI script.

   Read more

4. The PHP Reflection API in Detail: Inspecting Classes, Methods and Parameters at Runtime

   Dec 27, 2025

   The Reflection API turns PHP classes, methods, properties and parameters into inspectable objects at runtime. Anyone who wants to understand how dependency injection containers, ORMs and test frameworks work internally cannot avoid ReflectionClass, ReflectionMethod and ReflectionProperty, and using them correctly lets you build frameworks that adapt to arbitrary classes unknown at development time.

   Read more

5. Finding and Preventing Memory Leaks in Long-Running PHP Processes

   Dec 14, 2025

   A classic PHP-FPM request automatically frees all its memory at the end, while a Swoole or RoadRunner worker lives on through thousands of requests within the same process. That exact difference turns static state, forgotten closures and growing caches into a real memory leak that slowly eats up available memory over hours of operation.

   Read more

6. Currying and Partial Application in PHP

   Dec 13, 2025

   Currying breaks a multi-argument function into a chain of single-argument functions, partial application freezes some arguments upfront. Both techniques can be rebuilt in PHP 8.4 without any external library, using closures, and they cut repeated parameters down to a minimum.

   Read more

7. Publishing Your Own Composer Packages: From Idea to Packagist

   Dec 7, 2025

   Anyone who copies the same helper code into several projects eventually loses track of which version runs where. Your own Composer package solves this: one composer.json, one PSR-4 namespace, one version number per Git tag, and a single source of truth. This article walks the complete path from the first directory structure through Git tags to registration on Packagist, with real, traceable PHP 8.4 code.

   Read more

8. Named Arguments: More Readable Calls with Many Optional Parameters

   Dec 5, 2025

   Anyone who calls functions and constructors with many optional parameters knows the long lists of true, false and null whose meaning only becomes clear by looking at the signature. Named arguments solve this problem: the parameter name becomes visible right at the call site, order no longer matters, and unused defaults never have to be spelled out artificially.

   Read more

9. Evaluating PHP Attributes at Runtime: Using ReflectionAttribute Correctly

   Dec 5, 2025

   A PHP attribute is just metadata until someone reads it. Only ReflectionAttribute makes attributes usable at runtime, by extracting arguments, creating real instances and filtering by type. Understanding how ReflectionAttribute handles getArguments(), newInstance() and repeatable attributes lets you build validation, routing and serialization systems that need no external configuration files at all.

   Read more

10. PHP Serialization: JSON vs. serialize() Security Comparison

    Nov 30, 2025

    PHP serialization decides more than just the data format: serialize() is fast and preserves every object property, but quickly becomes an entry point for object injection with untrusted data. JSON is safe and language independent, at the cost of object fidelity and some speed. This article shows how both formats work internally, where unserialize() turns dangerous, and how a clean migration in existing systems succeeds.

    Read more