Skip to content

php.md

Latest commit

 

History

History
29 lines (25 loc) · 2.65 KB

php.md

File metadata and controls

29 lines (25 loc) · 2.65 KB
Raw

Development philosophy

  • Prefer simple solutions over clever ones.
  • Write code that is clear and self-explanatory.
  • Build with the long term in mind.

Stack

  • PHP
  • Tailwind CSS (if serving frontend)

Conventions

  • Always add declare(strict_types=1); as the first statement in every PHP file.
  • Always use Composer for dependency management and PSR-4 autoloading. Never manually require or include class files. Never run composer update in production — use composer install which respects composer.lock.
  • Always place every class in a namespace that maps to its file path per PSR-4. Never define classes in the global namespace.
  • Always use PDO with prepared statements and parameter binding for all database queries. Never interpolate or concatenate variables into SQL strings. Set PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION and PDO::ATTR_EMULATE_PREPARES => false.
  • Always use password_hash() with PASSWORD_DEFAULT for storing passwords and password_verify() for checking them. Never use md5(), sha1(), or any generic hashing function for passwords.
  • Always use exceptions for error signaling, not return codes. Catch specific exception types rather than bare \Exception. Never suppress errors with the @ operator.
  • Always inject dependencies through constructor parameters with type declarations. Never instantiate collaborators inside a class with new (except for value objects/DTOs). Never pass the DI container itself into application classes.
  • Always validate and sanitize all external input. Use filter_var() with specific filter constants for validation. Always use htmlspecialchars($string, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') when outputting user-supplied values into HTML.
  • Always configure sessions securely: use_strict_mode, use_only_cookies, cookie_httponly, cookie_secure, and cookie_samesite = "Lax". Always call session_regenerate_id(true) after any privilege change.
  • Always declare parameter types, return types, and property types on every method and property. Use enum instead of class constants for fixed sets of values.
  • Keep the public document root in a public/ directory containing only the front controller and static assets. Never place PHP source files, .env files, or composer.json inside the web-accessible document root.
  • Use PSR-3 LoggerInterface for logging. Never use error_log() or echo for application logging.

Verification

After making changes, always run the following checks and fix any issues before considering work complete:

  1. Lint: composer lint (PHP CS Fixer or PHP_CodeSniffer)
  2. Static analysis: composer analyse (PHPStan)
  3. Tests: composer test (PHPUnit)