Page 13 - PHP

Psalm vs. PHPStan is rarely a question of right or wrong, but of priorities: taint analysis and aggressive type narrowing speak for Psalm, a larger plugin ecosystem and mature generics support speak for PHPStan. This article compares both tools technically and provides a practical decision framework for teams.

Enforcing PSR-12 without blocking every pull request with comments about indentation and brace placement requires automation instead of good intentions. PHP_CodeSniffer and PHP-CS-Fixer, combined with pre-commit hooks and a CI pipeline, permanently end formatting discussions in review, even in grown legacy projects.

Memoization stores the result of a function on its first call and returns it instantly from cache on every further call with the same arguments. Because this technique is only guaranteed correct for referentially transparent, pure functions, memoization directly connects functional programming and performance optimization in PHP 8.4.

Anyone who treats the match expression and switch as interchangeable overlooks solid differences: match compares strictly with ===, has no fallthrough, and throws an UnhandledMatchError on an unhandled case, while switch compares loosely with == and simply does nothing without a match. This article uses PHP 8.4 code examples to show when the match expression is the more robust choice and where switch still has its place.

As soon as a system needs to interchangeably create multiple objects that belong together, for instance payment providers with a matching client, validator and logger, a simple factory method is no longer enough. The Abstract Factory pattern encapsulates exactly this creation of entire product families behind a shared, type-safe interface.

Anyone who still references methods and functions through strings like 'strlen' or arrays like [$object, 'method'] gives up type checking, IDE refactoring, and reliable visibility checks. First-class callable syntax turns those references into real, parser-resolved expressions and closes one of the last string-based gaps in the language.

Password hashing directly determines how expensive it is for an attacker to crack each individual password after a database leak. Argon2id is now considered the preferred algorithm because it is memory-intensive and therefore resistant to GPU- and ASIC-backed attacks, while bcrypt with its CPU-bound cost function has worked as a solid standard for decades. This article shows how to correctly configure, salt, pepper, and migrate both algorithms in production using the PHP standard API password_hash() and password_verify().

A deployment that works on a developer's machine but fails in production with a different package version can usually be traced back to a missing or mishandled composer.lock file. Anyone who understands how Composer builds hashes, how platform config influences resolution, and how merge conflicts arise in the lock file, builds PHP applications that install exactly the same package versions in every environment.

Using Doctrine or Eloquent is easy, understanding why they work the way they do is not. Once you have built your own minimal ORM, hydration, unit of work, and identity map stop being abstract terms and become concrete decisions with clear trade-offs.

OPcache Preloading loads selected classes and functions exactly once when a PHP-FPM worker starts, into a persistent memory area, so they are immediately available for every following request. Configured correctly it noticeably saves time for autoloading, inheritance resolution and interface checks, configured incorrectly it accomplishes nothing or produces hard to trace errors after every deploy.