Running a PHP Application inside a Container
https://forum.nuculabs.de/threads/running-a-php-application-inside-a-container.1/

https://redd.it/1lwoqn3
@r_php

Perennial Task: A CLI Task Manager Built With PHP
https://perennialtask.com/

https://redd.it/1lwtyb2
@r_php

assert() one more time

Does anyone actually use the assert() function, and if so, can explain its use with good practical examples?

I've read articles and subs about it but still dont really get it.

https://redd.it/1lwycdu
@r_php

Looking for Guidance: Building a Retro PHP/MySQL Social Network as a Serious Side Project

Hey everyone,

I’m currently building a project modeled after early 2000s-era social networks (think old-school Facebook vibes) using vanilla PHP and MySQL – no modern frameworks, no React, just classic tech with a passion for design accuracy.

I’ve built a working sign-up/login system, user profiles, and post functionality. Everything’s shaping up great, but I’m stuck on a few things like session handling, styling consistency, and dynamic content loading.

This is a personal learning project with long-term potential, and I’m not looking to sell anything or promote a product. Just hoping someone experienced with old-school PHP could nudge me in the right direction or even review my code for best practices.

If you enjoy web nostalgia or clean, efficient back-to-basics PHP work — would love to connect and I am open for the potential person to join as a founding partner in this venture

Thanks in advance 🙏

https://redd.it/1lx34cy
@r_php

Laravel Pipelines - Your expierence?

I recently implemented a workflow with the laravel Pipeline class (facade) and have to say it was a nice improvement for the structure and readability of my code. I think it's not that well-known and there is no "official" documentation, but other posts and some videos of Laravel itself (https://www.youtube.com/watch?v=2REc-Wlvl9M)


I'm working on Boxbase (https://boxbase.app), which, in a nutshell, is a gym-management software. I used the pipeline class to set up a new membership for a user. It involves a couple of steps like

Stripe
\- creating the membership itself
\- creating some related data (relations)
\- connecting to stripe if paid via Stripe


It looks something like this:

$membership = (new CreateMembershipAction())->execute($data);

$pipes =
CreateMembershipCyclePipe::class,
...,
CreateStripeResourceForMembershipPipe::class,
;

return Pipeline::send($membership)
->through($pipes)
->thenReturn();



I would love to hear about your experience with it or in which use cases you've used this flow. I think there's potential to make it very clear what's going on with that approach for other use cases as well.


If you have any experience, your feedback would be very helpful and appreciated. Thank you! 🙌

https://redd.it/1lx2jag
@r_php

Simple implementation of a radix tree based router for PHP.
https://github.com/Wilaak/RadixRouter

https://redd.it/1lx4249
@r_php

Help with PHP Fatal Error When Trying to Connect to MySQL Database

I've been trying to connect to my MySQL database using PHP, but I'm getting a fatal error that's driving me crazy. Here are the details of what I've tried so far:


I've made sure that the database connection settings in my code match the ones in my database configuration file. The connection string is correct and I'm not getting any errors when trying to connect using the command line.


The error message I get is:

Fatal error: Uncaught Error: Connection refused (ECONNREFUSED) in /path/to/my/noscript.php:12


I've tried increasing the timeout value, but it doesn't seem to be making a difference. Has anyone else experienced this issue before? What could be causing it?


Edit: I should mention that I'm using PHP 8 and MySQLi extension. Let me know if you have any suggestions for how to resolve this issue.

https://redd.it/1lx95n2
@r_php

Exploiting Public APP_KEY Leaks to Achieve RCE in Hundreds of Laravel Applications
https://blog.gitguardian.com/exploiting-public-app_key-leaks/

https://redd.it/1lxcbbw
@r_php

YetiSearch - A powerful PHP full text-search engine

Pleased to announce a new project of mine: YetiSearch is a powerful, pure-PHP search engine library designed for modern PHP applications. This initial release provides a complete full-text search solution with advanced features typically found only in dedicated search servers, all while maintaining the simplicity of a PHP library with zero external service dependencies.

https://github.com/yetidevworks/yetisearch


## Key Features:

1. Full-text search with relevance scoring using SQLite FTS5 and BM25 for accurate, ranked results.
2. Multi-index and faceted search across multiple sources, with filtering, aggregations, and deduplication.
3. Fuzzy matching and typo tolerance to improve user experience and handle misspellings.
4. Search result highlighting with customizable tags for visual emphasis on matched terms.
5. Advanced filtering using multiple operators (e.g., =, !=, <, in, contains, exists) for precise queries.
6. Document chunking and field boosting to handle large documents and prioritize key content.
7. Language-aware processing with stemming, stop words, and tokenization for 11 languages.
8. Geo-spatial search with radius, bounding box, and distance-based sorting using R-tree indexing.
9. Lightweight, serverless architecture powered by SQLite, with no external dependencies.
10. Performance-focused features like batch indexing, caching, transactions, and WAL support.



https://redd.it/1lxevpv
@r_php

Psalm or PHPstan?

P

https://redd.it/1lxmy92
@r_php

Dealing with form double submission

I remember when I was using symfony2, i had to deal with this manually in scenario that user click submit button multiple times in quick succession, creating multiple entries in database.

i wonder if this is taken care of by framework already (symfony 7.2.3) or do I still have to deal with it?

Best regards. Thanks for your help

https://redd.it/1lxrjor
@r_php

Secure, persistent, cross-domain web application authentication

Say you have a Laravel API that lives at backend.com. You also have multiple frontends that need to connect to it. These frontends have the following requirements:

\- First party (owned by you), and third party (owned by strangers) web apps.
\- All web apps will be on separate domains from the API (e.g. frontend1.com, frontend2.com, thirdparty1.com, etc).
\- The API must also serve mobile apps.
\- Authentication states must persist across device restarts (for UX).
\- Authentication must be secure, and prevent MITM, XSS, CSRF, etc.

How do you authenticate all these frontends to this backend API?

Laravel's authentication packages

Laravel has 2 headless authentication packages - Sanctum and Passport.

Sanctum
Sanctum offers 3 authentication methods:

1. API Token Authentication
2. SPA Authentication
3. Mobile Application Authentication

Exploring them individually:

1 API Token Authentication
This is not recommended by Laravel for first party SPA's, which prefers you to use the dedicated SPA Authentication. However Laravel does not acknowledge the difference between first party SPA's hosted on the same domain, and first party SPA's hosted on a separate domain.

Even if we treat our first party SPA as if it were a third party app, we still cannot use API Token Authentication because there is no way to securely persist authentication across browser / device restarts. Tokens can be stored in 3 ways:

1. In-memory, which is secure but not persistent
2. In localstorage, which is persistent but vulnerable to XSS
3. In sessionstorage, which is persistent but vulnerable to XSS

This rules out the out-of-the-box API Token Authentication .

2. SPA Authentication%3B-,SPA%20Authentication)
This is not possible, because it requires frontends to be on the same domain as the backend. E.g. frontend.myapp.com and backend.myapp.com. This does not meet our requirements for cross-domain auth, so we can rule it out.

3. Mobile Application Authentication
This is effectively the same as API Token Authentication, however mobile applications can securely store and persist tokens, so we can use this for our mobile apps. However we still have not solved the problem of web apps.

It seems there is no out-of-the-box method for secure, persistent, cross-domain authentication in Sanctum, so let's look at Passport.

Passport
Passport offers numerous authentication mechanisms, let's rule some of them out:

1. Password Grant is deprecated
2. Implicit Grant is deprecated
3. Client Credentials Grant is for machine-to-machine auth, not suitable for our purpose
4. Device Authorization Grant is for browserless or limited input devices, not suitable for our purposes

Therefore our options are:

1. Authorization Code Grant, with or without PKCE
2. Personal Access Tokens
3. SPA Authentication

Exploring them individually:

1 Authorization Code Grant (with or without PKCE)
For third party web apps Authorization Code Grant with PKCE is the way to go, however for first party apps this is overkill and detracts from user experience, as they are redirected out of frontend1.com to backend.com to login.

Even if you are willing to sacrifice a little bit of UX, this also simply returns a refresh_token as a JSON value, which cannot be securely persisted and runs into the same issues of secure storage (see Sanctum's API Token Authentication).

You can solve some of these problems

by customising Passport to return the refresh_token as a HttpOnly cookie, but this introduces other problems. We're going to park this idea for now and return to it later.

2. Personal Access Tokens
This is a very basic method for generating tokens for users. In itself, it does not attempt to do any authentication for the users session, and just provides a method for the user to generate authentication tokens for whatever they want.

3. SPA Authentication
Same as Sanctum, does not support cross-domain requests.

Summary
It appears there is no out-of-the-box solution from Sanctum or Passport for secure, persistent, cross-domain web application authentication. Therefore we have to explore custom solutions.

Custom solution
To implement this yourself you need to:

1. Use Passport Authorization Code Grant with PKCE, but modify it to:
1. Include an HttpOnly refresh_token cookie in your response instead of the JSON refresh token, along with your default access token
2. Store the access token in memory only, and make it short lived (e.g. 10-15 mins)
3. Define a custom middleware for the /oauth/token route. Laravel Passport's built-in refresh route expects a refresh_token param, and won't work with an HttpOnly cookie. Therefore your middleware will receive the refresh token cookie (using fetch's "credentials: include" or axios) and append it to the request params.
1. e.g. $request->merge(['refresh_token' => $cookie])
4. CSRF protect the /oauth/token route. Because you are now using cookies, you need to CSRF protect this route.

This solution gives you:

1. Persistence across device / browser restarts (via the HttpOnly cookie)
2. Security from XSS (Javanoscript cannot read HttpOnly cookies)
3. CSRF protection (via your custom CSRF logic)
4. Cross-domain authentication to your API via your access token

You will also need to scope the token, unless you want 1 token to authenticate all your frontends (e.g. logging in to frontend1.com logs you in to frontend2.com and frontend3.com).

Questions

1. What am I missing? This doesn't seem like a niche use case, and I'm sure someone else has solved this problem before. However I been back and forth through the docs and asked all the AI's I know, and I cannot find an existing solution.
2. If this is a niche use case without an out-of-the-box solution, how would you solve it? Is the custom solution I proposed the best way?

https://redd.it/1lxsvei
@r_php

Static Typing for the AWS SDK for PHP
https://chrastecky.dev/programming/static-typing-for-the-aws-sdk-for-php

https://redd.it/1lxvqm2
@r_php

Why are so many PHP devs just plain bad at coding?

Not even joking, I'm tired of this. So many PHP developers write total garbage and act like it's fine.
No patterns, no tests, no static analysis, nothing. Just throwing code around and praying it works. Some of them are even proud of it.

I told them to start using PHPStan, and it was like I spoke alien language. Some never even heard of it. Others said it forces unnecessary things like return types, and slows us down. WTF?

Honestly I bet a lot of ppl here never used PHPStan / Psalm or any style formatting tools like cs-fixer or rector. Or how many of you actually use declare(strict_types=1) as a default for every new file? Be honest.

This isn't rocket science. These are basic tools. If you're writing PHP and not using static analysis or formatters, you're just leaving a mess for the next dev who touches your code.

And worst part? These people dramatically increase technical debt for their companies. Working with their code becomes a total nightmare over time. But somehow they sell it to the business as performant development. Like oh we don’t need strict types, or unit tests, it just slows us down, we move fast
No you don’t. You move in circles, breaking shit

PHP isn't the problem. It’s this lazy it works so leave it mindset that kills projects slowly.

Just use the damn tools. It takes like 10 minutes to set up and saves everyone hours later

https://redd.it/1lxxhjf
@r_php

Do we really need all these long prefixes?
https://redd.it/1ly4ge8
@r_php

I made a todo-list generator for building Laravel apps, with Laravel ❤️ (work in progress)

https://redd.it/1lygdwl
@r_php

How are you all handling scheduled jobs and observability for background tasks like invoicing?

We've complex app built on top of symfony components a where we have background jobs like sending invoices, daily syncs etc.

Currently, we're triggering these jobs on a schedule and pushing them into a queue, but there's a concern around lack of observability like not knowing if a job actually ran, how long it took, or if/why it failed, unless we dig into logs or the queue backend.

Our devops team suggested moving this logic into an external workflow tool (like n8n) that calls our app’s API. That would give us history, logs, retries, error notifications, etc. But I’m still thinking whether there’s a better or more standard approach.

https://redd.it/1lynib9
@r_php