Page 2 - PHP

An upload form is one of the most direct attack surfaces of a PHP application, because it lets an attacker put fully controlled content onto the server. Relying solely on the file extension or the content type sent by the client opens the door to remote code execution, path traversal and injected script files disguised as harmless images.

Anyone who treats Value Objects as nothing more than fancier data classes gives up their real benefit: a Value Object encapsulates equality, validity, and immutability in exactly one place in the code, instead of scattering those rules across services, controllers, and forms. This article shows, in plain, framework-independent PHP 8.4, how to use equals() instead of naive comparison, how to enforce invariants inside the constructor, and how readonly properties deliver true immutability, all without losing the balance between objects that are too small and objects that are too large.

When a PHP application hits a hard computational ceiling, the classic path used to run through a custom C extension with its own build process. FFI lets you call existing native libraries directly from PHP code, with no compiler toolchain in the deployment, making performance-critical code practical for far more projects than before.

A custom query builder replaces fragile string concatenation with an object that assembles SQL expressions step by step, in a type safe and testable way. Understanding how a query builder works internally makes it easier to use finished solutions like Doctrine or Laravel Eloquent more deliberately, and to know when a custom build actually makes sense.

Promises encapsulate the result of an asynchronous operation before that result even exists, while a Deferred object provides control over resolution and rejection from the outside. Anyone who understands the three states of a promise, the rules of chaining and the common combinators can structure complex asynchronous workflows in PHP, whether with ReactPHP, Amp or a custom minimal implementation.

Anyone still running PHP 7.4 in production is operating a version without security updates on a codebase that barely any modern Composer package still supports. Migrating PHP 7 to PHP 8 is technically manageable once you understand the type system changes, removed functions, and string comparisons, and once you approach it systematically with PHPStan and Rector instead of improvising.

The ReactPHP event loop is the heart of every asynchronous PHP application built on React: a single thread that manages timers, watches file descriptors and runs callbacks in a clear order. Anyone who understands the tick cycle, the timer queue and how streams and promises interact writes code that truly does not block, instead of just looking like it does.

RFC 7807 defines a single, predictable JSON format for error responses: type, title, status, detail and instance. This article shows how a PHP API implements this format consistently, from the Problem Details class through the global exception handler to business validation errors with their own extension fields.

A Content Security Policy drastically reduces the risk of cross site scripting, yet many PHP applications either skip it entirely or copy a rigid policy straight from a tutorial. Generating the policy directly from PHP, with per request nonces and a controlled rollout through report only mode, gives you a protection mechanism that fits the application instead of blocking it.

Anyone who treats enums as nothing more than a type-safe list of constants is missing PHP's real strength: enums with interfaces implement genuine object-oriented behavior per case, replace match blocks scattered across the caller code with a single method inside the enum, and force new cases to surface through the compiler instead of through grep searches across the project.