php

# PHP ## Runtime and versioning - Run PHP 8.4 (active support) or 8.5 (latest stable). Never run EOL versions — no security patches - `declare(strict_types=1)` at top of every file - OPcache enabled in production. `opcache.preload` for warm startup on 8.0+ - JIT enabled for CPU-bound workloads: `opcache.jit=tracing`, `opcache.jit_buffer_size=128M`. Not beneficial for typical I/O-bound web apps — benchmark before enabling ## Type system - Type-hint all parameters, return types, and properties. No `mixed` — use union types (`int|string`) or generics via PHPDoc - `never` return type for functions that always throw or exit - `readonly` properties for value objects and DTOs (8.1+). `readonly` classes (8.2+) for fully immutable objects - Asymmetric visibility (8.4+): `public private(set)` for properties readable everywhere but writable only within class - Property hooks (8.4+): `get`/`set` hooks on properties — eliminates getter/setter boilerplate. Incompatible with `readonly` - Intersection types (8.1+): `Countable&Iterator`. DNF types (8.2+): `(A&B)|null` - Typed class constants (8.3+): `const string VERSION = '1.0'` - `#[Override]` attribute (8.3+) on overriding methods — compiler-checked safety net - Enums over constants for closed value sets (8.1+). Backed enums (`string`/`int`) for serialisation - Named arguments for multi-param functions with non-obvious order. Not for all calls - `match` over `switch` — exhaustive, no fall-through, returns value - First-class callable syntax (8.1+): `strlen(...)` over `Closure::fromCallable('strlen')` ## Modern syntax (8.4–8.5) - `new` without parentheses for chaining (8.4+): `new Collection()->filter()->map()` - Pipe operator (8.5+): `$result = $value |> trim(...) |> strtolower(...) |> htmlspecialchars(...)`. Prefer over nested calls - `clone with` (8.5+): `$new = clone $obj with {name: 'updated'}`. Preferred over manual clone + property set - Static property asymmetric visibility (8.5+): same syntax as instance properties - Lazy objects (8.4+): built-in lazy initialisation via `ReflectionClass::newLazyProxy()`. Use for expensive dependencies in DI containers - Driver-specific PDO classes (8.4+): `Pdo\Mysql`, `Pdo\Pgsql`, `Pdo\Sqlite` — type-safe, IDE-friendly alternatives to generic `PDO` ## Error handling - Throw exceptions, never return error codes or `false` - Catch specific exception types. Never catch `\Throwable` at the business layer - Custom exception classes for domain errors callers need to handle - Log full exception context. Never swallow silently - Fatal error backtraces (8.5+): enable via `zend.exception_ignore_args=0` — `error_get_last()` now includes trace key ## Security - Never trust user input. Validate and sanitise at every entry point - Parameterised queries only — PDO driver classes (8.4+) or `PDO` with prepared statements. Never string interpolation in SQL - `password_hash()` / `password_verify()` with `PASSWORD_BCRYPT` or `PASSWORD_ARGON2ID`. Never MD5/SHA1 - Escape all output for context: HTML → `htmlspecialchars()`, shell → `escapeshellarg()` or `proc_open()` with arg array (never shell string) - Never `eval()`, `exec()`, `system()`, `shell_exec()` with user-controlled input - Secrets in env or secret manager. Never in code or committed config - Session cookies: `HttpOnly`, `Secure`, `SameSite=Strict`. Partitioned cookie support (8.5+) via `setcookie()` `partitioned` option - CSP, CSRF protection, rate limiting on all forms and auth endpoints - `composer audit` in CI. Fail on known vulnerabilities - Keep dependencies updated. `composer outdated` as part of regular maintenance ## Architecture - PSR-12 coding standard. Enforce with PHP-CS-Fixer or Pint in CI - PSR-4 autoloading. No manual `require`/`include` in application code - Depend on abstractions (interfaces), not concretions. Inject dependencies - Service classes do one thing. No business logic in controllers or views - Value objects for domain concepts (Money, Email, UserId) — primitives leak - Repositories only when data source swapping is a real requirement ## Async and concurrency - Fibers (8.1+): cooperative multitasking within a single thread. Foundation for async runtimes - ReactPHP or AMPHP for event-loop-based async I/O. Swoole/OpenSwoole for coroutine-based high-concurrency servers - Shared-nothing model is default PHP. Fibers do not add multi-threading — I/O concurrency only - Avoid blocking calls (`file_get_contents`, `sleep`) inside fiber/event-loop context ## Composer and dependencies - Pin major versions in `composer.json`. `composer.lock` committed to git - `composer audit` and `composer outdated` in CI - `composer install --no-dev --optimize-autoloader` in production. Never `--no-scripts` unless you understand what you're skipping - Separate `require` from `require-dev`. Testing and analysis tools in dev only - Evaluate package maintenance health before adopting. Abandoned packages are a security risk ## Testing - Pest preferred for new projects. PHPUnit for existing codebases — don't mix - Test behaviour, not implementation. No exposing private methods for testing - Mock external services (HTTP, queues, storage). Never mock your own domain classes - PHPStan at level 8+ or Psalm with strict mode. Run in CI, fail on errors - Mutation testing with Infection for critical business logic - `phpbench` for performance-sensitive code. Benchmark before and after optimisation ## Performance - Profile first: Xdebug (development), Never optimise blind - Generators for large dataset iteration. Never load unbounded results into memory - Avoid N+1 queries. Eager-load relationships - `SplFixedArray` for large homogeneous datasets. Lower memory overhead than plain arrays - Fibers/async for I/O concurrency. JIT for CPU-bound computation