Web Development on Nalar

Feature Flags Without Long-Lived Technical Debt

Tue, 01 Sep 2026 00:00:00 +0700

Feature flags decouple code deployment from feature release. A team can deploy dormant code, enable it for internal users, roll it out gradually, and disable it without rebuilding the application.

The cost is hidden control flow. Every long-lived flag creates another possible system configuration, and interacting flags multiply those configurations quickly.

The engineering goal is therefore not “use flags everywhere.” It is to make each flag temporary, observable, and owned.

Idempotency Keys for Safe API Retries

Tue, 01 Sep 2026 00:00:00 +0700

Retries are essential in distributed systems. Networks fail, clients time out, load balancers reset connections, and responses sometimes disappear after a server has already committed a write.

The dangerous case is a retry of a non-idempotent operation. If a client sends POST /orders, times out, and sends the same request again, the server may create two orders even though the user intended one.

An idempotency key gives the client a stable identifier for one logical operation. The server remembers the result associated with that key and can return the same result when the request is retried.

Keyset Pagination in SQL for Fast, Stable APIs

Tue, 01 Sep 2026 00:00:00 +0700

Pagination looks simple until a table becomes large or new rows are inserted while a client is paging through results. LIMIT and OFFSET are easy to understand, but deep offsets can become expensive and changing data can make rows appear twice or disappear between requests.

Keyset pagination, also called seek pagination, avoids those problems by asking for rows after a known position instead of asking the database to skip a number of rows.

Liveness and Readiness Health Checks for Backend Services

Tue, 01 Sep 2026 00:00:00 +0700

Health endpoints look simple, but their semantics directly affect how a production platform routes traffic and restarts applications. A poorly designed check can turn a temporary database slowdown into a restart loop or send requests to an instance that has not finished initializing.

The most useful model separates two questions:

Liveness: Is this process still capable of running?
Readiness: Should this instance receive new traffic right now?

Those questions sound similar, but they should usually have different answers and different failure behavior.

Preventing SSRF in Backend Services That Fetch User-Supplied URLs

Tue, 01 Sep 2026 00:00:00 +0700

Features that fetch a URL supplied by a user appear in webhook testers, image importers, link previewers, document converters, and integration platforms. They also create a server-side request forgery (SSRF) boundary: an attacker can try to make the backend send requests to destinations the attacker cannot reach directly.

A secure design needs more than a blacklist of suspicious strings.

Understand the trust boundary

The dangerous capability is not URL parsing itself. It is allowing untrusted input to influence a network connection made with the server’s network identity.

Progressive Enhancement for Resilient Web Forms

Tue, 01 Sep 2026 00:00:00 +0700

A web form does not need JavaScript to submit data. That native capability is a useful reliability baseline.

Progressive enhancement starts with semantic HTML and a server endpoint that can complete the operation, then adds JavaScript for faster feedback or richer interactions. If the enhancement fails, the core task still has a path to succeed.

This approach is valuable even in highly interactive applications because JavaScript can fail for ordinary reasons: slow networks, stale cached chunks, browser extensions, runtime exceptions, or a partial deployment.

Safe Database Migrations with the Expand-and-Contract Pattern

Tue, 01 Sep 2026 00:00:00 +0700

A schema migration can be syntactically correct and still cause an outage. Production deployments often run old and new application versions at the same time, background workers may lag behind, and a large table can turn a simple-looking DDL statement into a long lock.

The expand-and-contract pattern reduces those risks by splitting an incompatible change into compatible stages.

Why one-step schema changes are risky

Suppose an application wants to rename users.full_name to users.display_name.

Building an Article CRUD with Laravel and Filament Admin Panel

Thu, 04 Sep 2025 00:00:00 +0700

Laravel provides a productive foundation for modern PHP applications, and Filament can add a powerful admin panel with generated forms, tables, and CRUD pages.

In this tutorial, we will create a Laravel project and build an Article CRUD resource with Filament.

1. Create a New Laravel Project

$el.innerText = 'Copy', 2000)" class="absolute top-2 right-2 bg-neutral-700 text-white text-xs px-2 py-1 rounded opacity-0 group-hover:opacity-100 transition-opacity" > Copy

composer create-project --prefer-dist laravel/laravel website

The final argument, website, is the project directory name. Change it if you want a different project name.

Automatically Encrypting Eloquent Model Attributes

Wed, 03 Sep 2025 00:00:00 +0700

Applications often store fields that deserve additional protection at rest. Laravel can encrypt selected Eloquent attributes before they are written to the database and decrypt them automatically when they are read.

For modern Laravel applications, the built-in encrypted cast is preferable to overriding Eloquent’s magic __get() and __set() methods. It integrates with the model casting system and avoids interfering with Eloquent internals.

Basic Implementation

Define encrypted attributes in the model’s casts:

Running Laravel Queues on cPanel with Cron Jobs

Wed, 03 Sep 2025 00:00:00 +0700

Laravel queues are useful for work that should not block an HTTP request, such as sending email, generating reports, importing data, or processing files. On a VPS, a process supervisor is usually the best way to keep long-running queue workers alive. Shared cPanel hosting often does not provide that option, so a cron-driven worker can be a practical fallback.

This pattern starts a worker periodically and tells it to exit once the queue becomes empty.

Building a Live Search Page in Filament PHP

Sat, 17 May 2025 00:00:00 +0700

Real-time search can make an admin dashboard much easier to use. Filament is built on Livewire, so a custom resource page can react to search input without writing a separate frontend application.

This example adds a live-search page to a PostResource.

1. Generate a Custom Page

Generate a custom page inside the resource:

$el.innerText = 'Copy', 2000)" class="absolute top-2 right-2 bg-neutral-700 text-white text-xs px-2 py-1 rounded opacity-0 group-hover:opacity-100 transition-opacity" > Copy

php artisan make:filament-page SearchPost --resource=PostResource --type=custom

The exact generated path can vary by Filament version and panel structure, so check the files created by the command.

Building a Nested Category API in Laravel 11: A Practical Guide

Sat, 24 Aug 2024 00:00:00 +0700

Nested categories are common in e-commerce platforms, CMS applications, documentation systems, and other products that need hierarchical navigation. In Laravel, a self-referencing Eloquent relationship can model a category that belongs to a parent and has any number of children.

This Laravel 11 example builds a small API for creating and reading category trees.

1. Create the Laravel Project

$el.innerText = 'Copy', 2000)" class="absolute top-2 right-2 bg-neutral-700 text-white text-xs px-2 py-1 rounded opacity-0 group-hover:opacity-100 transition-opacity" > Copy

composer create-project --prefer-dist laravel/laravel laravel-nested-categories
cd laravel-nested-categories
php artisan serve

2. Create the `Category` Model and Migration

$el.innerText = 'Copy', 2000)" class="absolute top-2 right-2 bg-neutral-700 text-white text-xs px-2 py-1 rounded opacity-0 group-hover:opacity-100 transition-opacity" > Copy

php artisan make:model Category -m

Define the table in the generated migration:

Building a Simple CRUD Application in Laravel: A Practical Guide

Sat, 24 Aug 2024 00:00:00 +0700

Building a CRUD application is one of the best ways to learn the core pieces of Laravel. In this guide, we will create a simple Post resource that supports Create, Read, Update, and Delete operations using Eloquent, resource routes, validation, and Blade views.

1. Create the Laravel Project

Make sure Composer and a supported PHP version are installed, then run:

$el.innerText = 'Copy', 2000)" class="absolute top-2 right-2 bg-neutral-700 text-white text-xs px-2 py-1 rounded opacity-0 group-hover:opacity-100 transition-opacity" > Copy

composer create-project --prefer-dist laravel/laravel laravel-crud
cd laravel-crud
php artisan serve

The development server is normally available at http://localhost:8000.

Data Validation in Laravel: A Complete Developer Guide

Thu, 22 Aug 2024 00:00:00 +0700

Validation is an important boundary in web applications. It ensures incoming data has the shape and constraints your application expects before that data reaches business logic or persistence. Laravel provides several validation APIs, from quick controller validation to reusable Form Request classes and custom rules.

1. Basic Validation

For small request handlers, call validate() on the request:

$el.innerText = 'Copy', 2000)" class="absolute top-2 right-2 bg-neutral-700 text-white text-xs px-2 py-1 rounded opacity-0 group-hover:opacity-100 transition-opacity" > Copy

use Illuminate\Http\Request;

public function store(Request $request)
{
    $validatedData = $request->validate([
        'name' => ['required', 'string', 'max:255'],
        'email' => ['required', 'email', 'unique:users,email'],
        'password' => ['required', 'string', 'min:8', 'confirmed'],
    ]);

    // Use $validatedData rather than the entire request payload.
}

For a normal browser request, Laravel redirects back with validation errors in the session. For requests expecting JSON, Laravel returns a validation error response, normally with HTTP status 422.

Using PHP's Built-In Server: A Quick Guide to `php -S`

Wed, 21 Aug 2024 00:00:00 +0700

When developing PHP applications, especially small projects or prototypes, configuring a full web server such as Apache or Nginx can be unnecessary. PHP includes a lightweight development server that starts with a single command: php -S.

It is convenient for local development and quick testing, but it is not designed for production traffic.

What Is `php -S`?

php -S starts PHP’s built-in development web server. It can serve PHP scripts and static files without a separate web-server configuration.

Backing Up a MySQL Database from PHP

Wed, 20 Mar 2024 00:00:00 +0700

Database backups are essential for recovery, migrations, and operational safety. Although PHP can query table definitions and manually generate SQL, a production-ready MySQL backup is better delegated to MySQL’s own mysqldump utility when it is available.

This guide shows how a PHP script can invoke mysqldump safely enough for a controlled server environment.

1. Define the Database and Backup Settings

$el.innerText = 'Copy', 2000)" class="absolute top-2 right-2 bg-neutral-700 text-white text-xs px-2 py-1 rounded opacity-0 group-hover:opacity-100 transition-opacity" > Copy

<?php
$host = 'localhost';
$user = 'backup_user';
$password = getenv('MYSQL_BACKUP_PASSWORD');
$database = 'your_database';
$backupFile = __DIR__ . '/backups/backup-' . date('Ymd-His') . '.sql';

Keep credentials out of source code whenever possible. Environment variables, secret stores, or protected configuration files are preferable to hard-coded passwords.

Finding the Last Day of a Month in PHP

Tue, 14 Jun 2022 00:00:00 +0700

Finding the number of days in a month is useful for reporting, billing periods, scheduling, and date validation. PHP can do this directly with its date APIs, including support for leap years.

A Simple `getLastDay` Function

The following function accepts a month in YYYY-MM format and returns the number of days in that month:

$el.innerText = 'Copy', 2000)" class="absolute top-2 right-2 bg-neutral-700 text-white text-xs px-2 py-1 rounded opacity-0 group-hover:opacity-100 transition-opacity" > Copy

function getLastDay(string $month): int
{
    $date = new DateTimeImmutable($month . '-01');
    return (int) $date->format('t');
}

How the Code Works

Create a date for the first day of the month

Extracting Usernames from Social Media URLs with PHP

Mon, 06 Jun 2022 00:00:00 +0700

Web applications sometimes need to extract a profile identifier from a social-media URL for normalization, imports, or display. PHP’s URL parsing functions are usually easier to maintain than one large regular expression because they let you validate the hostname and path separately.

A `parseUsername` Function

The following example supports several common profile URL formats:

$el.innerText = 'Copy', 2000)" class="absolute top-2 right-2 bg-neutral-700 text-white text-xs px-2 py-1 rounded opacity-0 group-hover:opacity-100 transition-opacity" > Copy

function parseUsername(string $url): string
{
    $host = strtolower((string) parse_url($url, PHP_URL_HOST));
    $path = trim((string) parse_url($url, PHP_URL_PATH), '/');

    $supportedHosts = [
        'twitter.com', 'www.twitter.com',
        'x.com', 'www.x.com',
        'medium.com', 'www.medium.com',
        'facebook.com', 'www.facebook.com',
        'vimeo.com', 'www.vimeo.com',
        'instagram.com', 'www.instagram.com',
    ];

    if (!in_array($host, $supportedHosts, true) || $path === '') {
        return $url;
    }

    return explode('/', $path)[0];
}

How It Works

Parse the hostname and path

Understanding HTTP Status Codes in Laravel: A Developer's Guide

Sat, 30 Jan 2021 00:00:00 +0700

HTTP status codes tell clients whether a request succeeded, failed, requires authentication, or encountered another condition. Choosing the right status code makes Laravel APIs easier to consume and helps clients implement predictable error handling.

200: OK

Use 200 OK when a request succeeds and the response includes a representation or other useful content.

Common cases:

A successful GET request that returns data.
A successful update that returns the updated resource.
A successful action endpoint that returns a result.

201: Created

Use 201 Created after successfully creating a new resource, usually from a POST request.

Managing Image Uploads and Resizing with Laravel and Intervention Image

Fri, 29 Jan 2021 00:00:00 +0700

Image handling is a common requirement in web applications. Uploading original files, creating thumbnails, converting formats, and cleaning up old files all need to be handled consistently. Laravel’s filesystem abstraction works well with image-processing libraries such as Intervention Image.

The code in this article uses the classic Intervention Image v2-style API (Image::make, fit, and encode). Intervention Image v3 uses a different API, so check the package version installed in your project before copying the example directly.

Web Development on Nalar

Feature Flags Without Long-Lived Technical Debt

Idempotency Keys for Safe API Retries

Keyset Pagination in SQL for Fast, Stable APIs

Liveness and Readiness Health Checks for Backend Services

Preventing SSRF in Backend Services That Fetch User-Supplied URLs

Understand the trust boundary

Progressive Enhancement for Resilient Web Forms

Safe Database Migrations with the Expand-and-Contract Pattern

Why one-step schema changes are risky

Building an Article CRUD with Laravel and Filament Admin Panel

1. Create a New Laravel Project

Automatically Encrypting Eloquent Model Attributes

Basic Implementation

Running Laravel Queues on cPanel with Cron Jobs

Building a Live Search Page in Filament PHP

1. Generate a Custom Page

Building a Nested Category API in Laravel 11: A Practical Guide

1. Create the Laravel Project

2. Create the Category Model and Migration

Building a Simple CRUD Application in Laravel: A Practical Guide

1. Create the Laravel Project

Data Validation in Laravel: A Complete Developer Guide

1. Basic Validation

Using PHP's Built-In Server: A Quick Guide to `php -S`

What Is php -S?

Backing Up a MySQL Database from PHP

1. Define the Database and Backup Settings

Finding the Last Day of a Month in PHP

A Simple getLastDay Function

How the Code Works

Extracting Usernames from Social Media URLs with PHP

A parseUsername Function

How It Works

Understanding HTTP Status Codes in Laravel: A Developer's Guide

200: OK

201: Created

Managing Image Uploads and Resizing with Laravel and Intervention Image

2. Create the `Category` Model and Migration

What Is `php -S`?

A Simple `getLastDay` Function

A `parseUsername` Function