PHP

PHP Development

Modern PHP 8.x development patterns and best practices.

PHP 8.x Features

Constructor Property Promotion

// Before PHP 8
class User {
    private string $name;
    private int $age;

    public function __construct(string $name, int $age) {
        $this->name = $name;
        $this->age = $age;
    }
}

// PHP 8+
class User {
    public function __construct(
        private string $name,
        private int $age,
        private bool $active = true
    ) {}
}

Named Arguments

function createUser(string $name, string $email, bool $admin = false): User {
    // ...
}

// Named arguments (order doesn't matter)
createUser(email: 'john@example.com', name: 'John', admin: true);

Match Expression

// BAD: Switch with many breaks
switch ($status) {
    case 'pending':
        $color = 'yellow';
        break;
    case 'approved':
        $color = 'green';
        break;
    default:
        $color = 'gray';
}

// GOOD: Match expression
$color = match($status) {
    'pending' => 'yellow',
    'approved', 'published' => 'green',
    'rejected' => 'red',
    default => 'gray',
};

Null Safe Operator

// Before
$country = null;
if ($user !== null && $user->getAddress() !== null) {
    $country = $user->getAddress()->getCountry();
}

// PHP 8+
$country = $user?->getAddress()?->getCountry();

Union Types & Intersection Types

// Union types
function process(int|float|string $value): int|float {
    return is_string($value) ? strlen($value) : $value * 2;
}

// Intersection types (PHP 8.1+)
function save(Countable&Iterator $items): void {
    foreach ($items as $item) {
        // ...
    }
}

Enums (PHP 8.1+)

enum Status: string {
    case Draft = 'draft';
    case Published = 'published';
    case Archived = 'archived';

    public function label(): string {
        return match($this) {
            self::Draft => 'Draft',
            self::Published => 'Published',
            self::Archived => 'Archived',
        };
    }

    public function color(): string {
        return match($this) {
            self::Draft => 'gray',
            self::Published => 'green',
            self::Archived => 'red',
        };
    }
}

// Usage
$post->status = Status::Published;
echo $post->status->label(); // "Published"

Readonly Properties (PHP 8.1+)

class User {
    public function __construct(
        public readonly int $id,
        public readonly string $email,
        private string $password
    ) {}
}

$user = new User(1, 'john@example.com', 'hashed');
$user->id = 2; // Error: Cannot modify readonly property

Type Safety

Strict Types

<?php
declare(strict_types=1);

function add(int $a, int $b): int {
    return $a + $b;
}

add(1, 2);     // OK
add('1', '2'); // TypeError

Return Types

class UserRepository {
    public function find(int $id): ?User {
        // Returns User or null
    }

    public function findOrFail(int $id): User {
        return $this->find($id) ?? throw new NotFoundException();
    }

    public function all(): array {
        // Returns array of Users
    }

    public function save(User $user): void {
        // Returns nothing
    }

    public function delete(User $user): never {
        // Never returns (throws or exits)
        throw new NotImplementedException();
    }
}

OOP Patterns

Dependency Injection

// BAD: Hard dependency
class OrderService {
    private $mailer;

    public function __construct() {
        $this->mailer = new SmtpMailer(); // Hard to test
    }
}

// GOOD: Dependency injection
interface MailerInterface {
    public function send(string $to, string $subject, string $body): void;
}

class OrderService {
    public function __construct(
        private MailerInterface $mailer,
        private LoggerInterface $logger
    ) {}

    public function complete(Order $order): void {
        $this->mailer->send($order->email, 'Order Complete', '...');
        $this->logger->info('Order completed', ['id' => $order->id]);
    }
}

Value Objects

final class Email {
    private function __construct(
        private readonly string $value
    ) {}

    public static function fromString(string $email): self {
        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
            throw new InvalidArgumentException('Invalid email');
        }
        return new self(strtolower($email));
    }

    public function toString(): string {
        return $this->value;
    }

    public function equals(self $other): bool {
        return $this->value === $other->value;
    }
}

// Usage
$email = Email::fromString('John@Example.com');
echo $email->toString(); // "john@example.com"

Repository Pattern

interface UserRepositoryInterface {
    public function find(int $id): ?User;
    public function findByEmail(string $email): ?User;
    public function save(User $user): void;
    public function delete(User $user): void;
}

class DatabaseUserRepository implements UserRepositoryInterface {
    public function __construct(
        private PDO $pdo
    ) {}

    public function find(int $id): ?User {
        $stmt = $this->pdo->prepare('SELECT * FROM users WHERE id = ?');
        $stmt->execute([$id]);
        $row = $stmt->fetch(PDO::FETCH_ASSOC);
        return $row ? $this->hydrate($row) : null;
    }

    private function hydrate(array $data): User {
        return new User(
            id: $data['id'],
            email: $data['email'],
            name: $data['name']
        );
    }
}

Error Handling

Custom Exceptions

class DomainException extends Exception {}
class ValidationException extends DomainException {}
class NotFoundException extends DomainException {}

class InsufficientFundsException extends DomainException {
    public function __construct(
        public readonly float $balance,
        public readonly float $required
    ) {
        parent::__construct(
            "Insufficient funds: have {$balance}, need {$required}"
        );
    }
}

// Usage
throw new InsufficientFundsException(balance: 50.00, required: 100.00);

Try-Catch Best Practices

// BAD: Catching generic Exception
try {
    $result = $service->process($data);
} catch (Exception $e) {
    log($e->getMessage());
}

// GOOD: Specific exception handling
try {
    $result = $service->process($data);
} catch (ValidationException $e) {
    return response()->json(['errors' => $e->getErrors()], 422);
} catch (NotFoundException $e) {
    return response()->json(['error' => 'Not found'], 404);
} catch (Throwable $e) {
    $this->logger->error('Unexpected error', ['exception' => $e]);
    return response()->json(['error' => 'Server error'], 500);
}

Security

Input Validation

// Always validate and sanitize input
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
$age = filter_input(INPUT_POST, 'age', FILTER_VALIDATE_INT, [
    'options' => ['min_range' => 0, 'max_range' => 150]
]);

if ($email === false || $email === null) {
    throw new ValidationException('Invalid email');
}

Password Hashing

// Always use password_hash/password_verify
$hash = password_hash($password, PASSWORD_DEFAULT);

if (password_verify($inputPassword, $storedHash)) {
    // Password correct

    // Rehash if needed (algorithm upgrade)
    if (password_needs_rehash($storedHash, PASSWORD_DEFAULT)) {
        $newHash = password_hash($inputPassword, PASSWORD_DEFAULT);
        $user->updatePassword($newHash);
    }
}

SQL Injection Prevention

// BAD: Direct concatenation
$sql = "SELECT * FROM users WHERE email = '$email'"; // VULNERABLE

// GOOD: Prepared statements
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = ?');
$stmt->execute([$email]);

// GOOD: Named parameters
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email AND status = :status');
$stmt->execute(['email' => $email, 'status' => 'active']);

Testing

PHPUnit

class UserServiceTest extends TestCase {
    private UserService $service;
    private MockObject $repository;

    protected function setUp(): void {
        $this->repository = $this->createMock(UserRepositoryInterface::class);
        $this->service = new UserService($this->repository);
    }

    public function testFindUserReturnsUser(): void {
        $expected = new User(1, 'john@example.com');
        $this->repository
            ->expects($this->once())
            ->method('find')
            ->with(1)
            ->willReturn($expected);

        $result = $this->service->find(1);

        $this->assertEquals($expected, $result);
    }

    public function testFindUserThrowsWhenNotFound(): void {
        $this->repository
            ->method('find')
            ->willReturn(null);

        $this->expectException(NotFoundException::class);

        $this->service->findOrFail(999);
    }
}

Data Providers

#[DataProvider('validEmailProvider')]
public function testValidEmails(string $email): void {
    $result = Email::fromString($email);
    $this->assertInstanceOf(Email::class, $result);
}

public static function validEmailProvider(): array {
    return [
        'simple' => ['test@example.com'],
        'with subdomain' => ['test@mail.example.com'],
        'with plus' => ['test+label@example.com'],
    ];
}

Performance

Opcache

; php.ini
opcache.enable=1
opcache.memory_consumption=256
opcache.max_accelerated_files=20000
opcache.validate_timestamps=0  ; Production only

Array Functions

// Use array functions instead of loops when possible
$names = array_map(fn($user) => $user->name, $users);
$adults = array_filter($users, fn($user) => $user->age >= 18);
$total = array_reduce($orders, fn($sum, $order) => $sum + $order->total, 0);

// Generators for large datasets
function readLargeFile(string $path): Generator {
    $handle = fopen($path, 'r');
    while (($line = fgets($handle)) !== false) {
        yield trim($line);
    }
    fclose($handle);
}

foreach (readLargeFile('huge.csv') as $line) {
    // Process one line at a time, low memory
}

Composer Best Practices

{
    "require": {
        "php": "^8.2",
        "monolog/monolog": "^3.0"
    },
    "require-dev": {
        "phpunit/phpunit": "^10.0",
        "phpstan/phpstan": "^1.0"
    },
    "autoload": {
        "psr-4": {
            "App\\": "src/"
        }
    },
    "config": {
        "sort-packages": true,
        "optimize-autoloader": true
    }
}

# Production deployment
composer install --no-dev --optimize-autoloader --classmap-authoritative