Web Development

Feature flags decouple code deployment from feature release. A team can deploy dormant code, enable it for internal users, roll it out gradually, and disable it without rebuilding the application. The cost is hidden control flow. Every long-lived flag creates another possible system configuration, and interacting flags multiply those configurations quickly. The engineering goal is therefore not “use flags everywhere.” It is to make each flag temporary, observable, and owned.

Retries are essential in distributed systems. Networks fail, clients time out, load balancers reset connections, and responses sometimes disappear after a server has already committed a write. The dangerous case is a retry of a non-idempotent operation. If a client sends POST /orders, times out, and sends the same request again, the server may create two orders even though the user intended one. An idempotency key gives the client a stable identifier for one logical operation. The server remembers the result associated with that key and can return the same result when the request is retried.

Pagination looks simple until a table becomes large or new rows are inserted while a client is paging through results. LIMIT and OFFSET are easy to understand, but deep offsets can become expensive and changing data can make rows appear twice or disappear between requests. Keyset pagination, also called seek pagination, avoids those problems by asking for rows after a known position instead of asking the database to skip a number of rows.

Health endpoints look simple, but their semantics directly affect how a production platform routes traffic and restarts applications. A poorly designed check can turn a temporary database slowdown into a restart loop or send requests to an instance that has not finished initializing. The most useful model separates two questions: Liveness: Is this process still capable of running? Readiness: Should this instance receive new traffic right now? Those questions sound similar, but they should usually have different answers and different failure behavior.

Features that fetch a URL supplied by a user appear in webhook testers, image importers, link previewers, document converters, and integration platforms. They also create a server-side request forgery (SSRF) boundary: an attacker can try to make the backend send requests to destinations the attacker cannot reach directly. A secure design needs more than a blacklist of suspicious strings. Understand the trust boundary The dangerous capability is not URL parsing itself. It is allowing untrusted input to influence a network connection made with the server’s network identity.

A web form does not need JavaScript to submit data. That native capability is a useful reliability baseline. Progressive enhancement starts with semantic HTML and a server endpoint that can complete the operation, then adds JavaScript for faster feedback or richer interactions. If the enhancement fails, the core task still has a path to succeed. This approach is valuable even in highly interactive applications because JavaScript can fail for ordinary reasons: slow networks, stale cached chunks, browser extensions, runtime exceptions, or a partial deployment.

A schema migration can be syntactically correct and still cause an outage. Production deployments often run old and new application versions at the same time, background workers may lag behind, and a large table can turn a simple-looking DDL statement into a long lock. The expand-and-contract pattern reduces those risks by splitting an incompatible change into compatible stages. Why one-step schema changes are risky Suppose an application wants to rename users.full_name to users.display_name.

Laravel provides a productive foundation for modern PHP applications, and Filament can add a powerful admin panel with generated forms, tables, and CRUD pages. In this tutorial, we will create a Laravel project and build an Article CRUD resource with Filament. 1. Create a New Laravel Project Copy composer create-project --prefer-dist laravel/laravel website The final argument, website, is the project directory name. Change it if you want a different project name.

Applications often store fields that deserve additional protection at rest. Laravel can encrypt selected Eloquent attributes before they are written to the database and decrypt them automatically when they are read. For modern Laravel applications, the built-in encrypted cast is preferable to overriding Eloquent’s magic __get() and __set() methods. It integrates with the model casting system and avoids interfering with Eloquent internals. Basic Implementation Define encrypted attributes in the model’s casts:

Laravel queues are useful for work that should not block an HTTP request, such as sending email, generating reports, importing data, or processing files. On a VPS, a process supervisor is usually the best way to keep long-running queue workers alive. Shared cPanel hosting often does not provide that option, so a cron-driven worker can be a practical fallback. This pattern starts a worker periodically and tells it to exit once the queue becomes empty.

Real-time search can make an admin dashboard much easier to use. Filament is built on Livewire, so a custom resource page can react to search input without writing a separate frontend application. This example adds a live-search page to a PostResource. 1. Generate a Custom Page Generate a custom page inside the resource: Copy php artisan make:filament-page SearchPost --resource=PostResource --type=custom The exact generated path can vary by Filament version and panel structure, so check the files created by the command.

Nested categories are common in e-commerce platforms, CMS applications, documentation systems, and other products that need hierarchical navigation. In Laravel, a self-referencing Eloquent relationship can model a category that belongs to a parent and has any number of children. This Laravel 11 example builds a small API for creating and reading category trees. 1. Create the Laravel Project Copy composer create-project --prefer-dist laravel/laravel laravel-nested-categories cd laravel-nested-categories php artisan serve 2. Create the Category Model and Migration Copy php artisan make:model Category -m Define the table in the generated migration:

Building a CRUD application is one of the best ways to learn the core pieces of Laravel. In this guide, we will create a simple Post resource that supports Create, Read, Update, and Delete operations using Eloquent, resource routes, validation, and Blade views. 1. Create the Laravel Project Make sure Composer and a supported PHP version are installed, then run: Copy composer create-project --prefer-dist laravel/laravel laravel-crud cd laravel-crud php artisan serve The development server is normally available at http://localhost:8000.

Validation is an important boundary in web applications. It ensures incoming data has the shape and constraints your application expects before that data reaches business logic or persistence. Laravel provides several validation APIs, from quick controller validation to reusable Form Request classes and custom rules. 1. Basic Validation For small request handlers, call validate() on the request: Copy use Illuminate\Http\Request; public function store(Request $request) { $validatedData = $request->validate([ 'name' => ['required', 'string', 'max:255'], 'email' => ['required', 'email', 'unique:users,email'], 'password' => ['required', 'string', 'min:8', 'confirmed'], ]); // Use $validatedData rather than the entire request payload. } For a normal browser request, Laravel redirects back with validation errors in the session. For requests expecting JSON, Laravel returns a validation error response, normally with HTTP status 422.

When developing PHP applications, especially small projects or prototypes, configuring a full web server such as Apache or Nginx can be unnecessary. PHP includes a lightweight development server that starts with a single command: php -S. It is convenient for local development and quick testing, but it is not designed for production traffic. What Is php -S? php -S starts PHP’s built-in development web server. It can serve PHP scripts and static files without a separate web-server configuration.

Database backups are essential for recovery, migrations, and operational safety. Although PHP can query table definitions and manually generate SQL, a production-ready MySQL backup is better delegated to MySQL’s own mysqldump utility when it is available. This guide shows how a PHP script can invoke mysqldump safely enough for a controlled server environment. 1. Define the Database and Backup Settings Copy <?php $host = 'localhost'; $user = 'backup_user'; $password = getenv('MYSQL_BACKUP_PASSWORD'); $database = 'your_database'; $backupFile = __DIR__ . '/backups/backup-' . date('Ymd-His') . '.sql'; Keep credentials out of source code whenever possible. Environment variables, secret stores, or protected configuration files are preferable to hard-coded passwords.

Finding the number of days in a month is useful for reporting, billing periods, scheduling, and date validation. PHP can do this directly with its date APIs, including support for leap years. A Simple getLastDay Function The following function accepts a month in YYYY-MM format and returns the number of days in that month: Copy function getLastDay(string $month): int { $date = new DateTimeImmutable($month . '-01'); return (int) $date->format('t'); } How the Code Works Create a date for the first day of the month

Web applications sometimes need to extract a profile identifier from a social-media URL for normalization, imports, or display. PHP’s URL parsing functions are usually easier to maintain than one large regular expression because they let you validate the hostname and path separately. A parseUsername Function The following example supports several common profile URL formats: Copy function parseUsername(string $url): string { $host = strtolower((string) parse_url($url, PHP_URL_HOST)); $path = trim((string) parse_url($url, PHP_URL_PATH), '/'); $supportedHosts = [ 'twitter.com', 'www.twitter.com', 'x.com', 'www.x.com', 'medium.com', 'www.medium.com', 'facebook.com', 'www.facebook.com', 'vimeo.com', 'www.vimeo.com', 'instagram.com', 'www.instagram.com', ]; if (!in_array($host, $supportedHosts, true) || $path === '') { return $url; } return explode('/', $path)[0]; } How It Works Parse the hostname and path

HTTP status codes tell clients whether a request succeeded, failed, requires authentication, or encountered another condition. Choosing the right status code makes Laravel APIs easier to consume and helps clients implement predictable error handling. 200: OK Use 200 OK when a request succeeds and the response includes a representation or other useful content. Common cases: A successful GET request that returns data. A successful update that returns the updated resource. A successful action endpoint that returns a result. 201: Created Use 201 Created after successfully creating a new resource, usually from a POST request.

Image handling is a common requirement in web applications. Uploading original files, creating thumbnails, converting formats, and cleaning up old files all need to be handled consistently. Laravel’s filesystem abstraction works well with image-processing libraries such as Intervention Image. The code in this article uses the classic Intervention Image v2-style API (Image::make, fit, and encode). Intervention Image v3 uses a different API, so check the package version installed in your project before copying the example directly.