[UPDATE: After all the suggestions and feedback, I stuck with the Laravel framework and switched to a Digital Ocean droplet. All of the performance issues and deployment pains went away instantly. Thank you to all who contributed!]

I've been using PHP casually for decades. In the last two years I've started to try to take it more seriously, and that inevitably led me to Laravel. For basic CRUD sites, Laravel has been a godsend, allowing scaffolding of a ton of functionality pretty quickly, Blade templates make sense to me, the workflow works for me.

Deployment is where things have been tricky. Since I do this as a hobby and my user count is in the single digits per day, I use shared hosting. Deploying a Laravel application to shared hosting is pretty rough. I've managed it, but queries are extremely slow, everything feels sluggish, etc.

So, in an attempt to weigh the pros and cons, I went to packagist.org and started to look into cobbling together my own packages to find a happy medium between writing all my own libraries (I do not relish the idea of going back to this) and full-blown frameworks like Laravel.

But, I've run into an issue I did not expect: everything seems to be deprecated in the latest versions of PHP. FastRouter's page one Github documentation references classes that don't seem to exist in the project anymore, meaning that basic functionality required me digging into the code to find out why classes weren't there. PHP-Auth throws sixteen deprecation flags when just creating the instance of the Auth class.

The standalone Blade templating engine doesn't work. Twig does - and actually works as described, so kudos to them.

All of this to state my theory: Everyone in PHP has gone to Laravel or Symfony and never looked back. This has inevitably led to all the standalone packages rotting.

Or, I'm an idiot and doing something obviously wrong.

To my question: Is it even worth it to try to cobble together something small and simple anymore? Just with FastRouter, PHP-Auth, and Twig templating I'm finding my workflow is SIGNIFICANTLY slower than just using Laravel. And PHP-Auth won't even work, so I'm back to rolling my own, which I do not want to do.

I just want some simple session authenticating, I don't need OAuth2.

Anyway, I'm open to hearing discussion on this, and I'd appreciate those more knowledgeable than I chiming in.

Thank you.

I have the same reaction every time I look at the documentation of Laravel : "what, why??"

It doesn't seem structured.

So much 'magic' going on too.

Is it about the community then?

Or are there things I'm clearly missing?

Hi, I had someone from Fiverr work on my website, and after he was "done" (Big dispute in quality thus the "") Wordfence threw a high threat error to file in a plugin. It was titled js.php.

I downloaded the updated version of the plugin to view whether it comes with that plugin naturally and could be false positive. It was not in it...now, I have some customizations configured with the plugin so I am trying to not delete and reinstall the plugin.

Also if it is indeed malicious I would want to report it to Fiverr.

Here is the code, can someone please tell me what function it is trying to perform?

Thank you!

Code: https://pastebin.com/jscarvU7

Edit: Solved by /u/jules190 he went above and beyond decoded. Thank you /u/primeviltom too for the input.

I have reported him to Fiverr with all the logs that show the activity. For fun, I will post an update edit to how they handle it in case anyone cares. I am hoping they reach out to anyone he previously worked with as some might be running entire eCommerce stores with that code injected :(

Organización pequeña, sitio web antiguo con PHP 5.6 (Apache, Debian, sin framework, código antiguo con mysql__* por todas partes). Desde ayer, sufre ataques de bots en oleadas cada pocos minutos. El registro de errores está lleno de:

Error fatal de PHP: Se agotó el límite de memoria permitida de 134217728 bytes

Señal de salida del proceso hijo pid 18537: Fallo de segmentación (11)

Muchas solicitudes POST multipart extrañas a páginas que ni siquiera admiten subidas de archivos. Hoy lo hemos desconectado.

Encontramos un archivo PHP en la carpeta de subidas que nadie creó (eval/base64 ofuscado) y una tarea programada (cron job) en www-data que se ejecuta cada 5 minutos. Supongo que lograron entrar.

Intenté migrarlo a PHP 8, pero falla al instante (mysql_connect indefinido). No hay parche oficial para la versión 5.6.

¿Qué harías? ¿Recompilarlo desde cero y servir una versión estática por ahora? ¿Hay alguna forma rápida de portar la parte de mysql_connect o es necesario reescribir el código?

Edit 1: Just to clarify, I'm not the one running this operation. It's an older guy, very old-school, "if it ain't broke don't fix it." Guess it worked for him all this time. That said, I've seen people here and on other subs treating this like the end of the world. It's serious, no doubt, NSA put out an advisory and there's active exploitation in the wild, but part of what went down is already coming back online, and anyone who kept their stack current rode it out fine. As devs I think we should keep cooler heads and trust what we know how to do, without tipping into arrogance or ego.

So I would like some input on what to do. I work for a company who has a code base which is 14 years old, written in raw PHP, no framework. Over the years, it has basically become a custom framework, but does have some modern stuff in it. Implements composer to include libraries, is updated frequently to support the latest version of PHP, etc. The application makes the company millions annually and is the core of the business.

Now the problem.

Our dev team is very small, only 5 people and we don't have a ton of resources to spend years re-writing everything (updating what we can as we go along). We recently hired two new dev's (young) and all they keep saying is the system is "awful/terrible" and needs to be completely re-written in Laravel. So much so, that they won't touch it and won't look at anything else aside from Laravel, not even other packages. I would recommend a package they could use and the answer is always, "Laravel does that better". They then (without telling me), implemented all of Laravel into the code base with composer and changed so much about how Laravel gets initialized with custom functions just to get it working inside our custom framework. So we now have our custom system, with Laravel running a few pages because they didn't want to use the system the way it was built. They could have instead included maybe 4-5 additional packages from Laravel, Symfony, and Cake, without changing too much and achieved the exact same thing. Not only that, the Laravel code which was written is very complex (when it didn't need to be) and very hard to debug anything.

Now my experience with Laravel has been, well, awful. I worked on three projects so far (v4.2, v5.3, v5.5) and Laravel changes so f***** much and a lot of people (not all) are so inexperienced with it (read a few docs/watch a few videos and think they are God), that it got to a point we could not upgrade Laravel without re-writing the entire application, only after about two years of development. I don't want that to happen as the app makes the company a ton of money. By updating it periodically as we go using our system, allows us to keep up with new features without relying on a whole new framework, or Tyler deciding he doesn't want to work on Laravel anymore, it dying off and we are all screwed. We also know our custom code inside and out, what every call and every function does. At the same time though, I also realize that our custom system could be improved in some areas and has a learning curve to it for anyone new coming in.

I'm torn on how to proceed. Do I give in and let them do the Laravel route, potentially breaking it in the future causing a tremendous amount of hassle, or do I put my foot down and say, no, this is how we do it here, if you don't like it i'll find someone else. Based on my experience with Laravel, I don't ever want to touch it as a full framework again. It is way too bloated, makes simple stuff complicated as hell, is a pain in the ass to debug if stuff does go wrong, and feels like some of it is strapped together with duct tape. That being said those, some of the individual packages which make it up are actually really useful and flushed out.

EDIT: Thanks for all the comments. I was mainly looking to see what other people's thought on my situation was and their input. Thinking about it more, I think it is time to re-think how we do code deployments/review so to try and prevent this from happening/catch stuff earlier. Laravel inside of it needs to go. If it were a brand new project, then maybe, but not something established like our app.

Also, thanks for the tips on the additional readings/suggestions. It is always good to learn new stuff/see what is out there.

Hello, I went to college for software development and the subject of using frameworks didn't come up throughout the 2 PHP courses I took. After I graduated, I really took to making applications with PHP over other languages.

After about a year of practice of making my own applications and creating my own templates, I decided to see what the fuss was about with commercial grade frameworks such as Symfony and Laravel. I did some tutorials and made some simple applications and to be honest, I really don't see the need for some of these frameworks.

To me it seems that when I use a framework, I have to know how to use PHP + the framework, instead of just understanding PHP. I am currently learning Laravel and I do see the nice advantages of using this framework such as database seeders, built in authentication classes.

The problem I have is getting my head wrapped around is why using a framework like Laravel/Symfony would be better for me learn/use instead of just making a lightweight framework for myself (other than they are considered an industry standard)? Are there companies that do this already with their own PHP code?

I have not worked on a team of developers, so there is that to consider, but as someone who just likes PHP and wants to code with PHP, should I consider a commercial framework? And some background info, I just learned what PHP was about a year ago, I also work as an IT technician where my boss lets me make my own apps for our organization.

TLDR: Why should I learn a framework like Laravel or Symfony over creating my own framework?

EDIT!!!:

Hello all, you guys are the best and I really appreciate your feedback. I think I learned more than I had anticipated. I will not be answering any more new posts but will continue reading them what everyone has to say.

For what fits me, I think what I will be doing is to continue to learn Laravel for now until I get most of the basics down, make a few apps, see how i like it, then switch over to Symfony and see what it is like.

I did not think about until someone pointed it out, but I can just add my own stuff to the framework if I don't like the tools available.

Thank you all! I really appreciate the feedback!

I've noticed that recently many questions in this sub are getting zero score (I removed my upvotes temporarily for sake of demonstration). And with 0 points (50% upvoted) it likely means that it takes just one grumpy person to discourage the poster. Please don't be indifferent, upvote a question if you consider it legit, whether it has 0 or 1, letting the opening poster they are welcome here. There is nothing wrong with PDO limit, mysqli_connect(), Front-end Technology questions, even though they are not that exciting. And the Security issue one is actually hot. Nevertheless all of them currently has 0 score, discouraging the posters. Heck, even though I don't like the AI question, I just left it alone, moving to other questions that interest me.

I always thought of this sub as of a friendly and non-judging and rather unique place that is focused on providing help first hand, as opposed to stack overflow, where questions are just building material for their shiny library of great answers, where unfit questions are just thrown away. So let's make this sub a welcome place.

Is there an advantage to using Docker over XAMPP to run PHP scripts?

I've been using only XAMPP and don't know much about Docker (or XAMPP for that matter). Apparently, it creates containers to run apps.

Is it better to use Docker to run PHP code? Also, is it overall a good skill to have as someone trying to transition into a career in web/WordPress development?

Edit: Thanks to the nice people on Reddit, we set up a Discord to drop into when you fancy to talk shop: https://discord.gg/AQJ8xxsZFk

I'm much more productive when working on my own on projects. I can crack on and get the job done without the usual layers of management you'd typically see in a day job.

However, I've started to miss being around other developers. Whether that's an intellectually stimulating lunchtime chat, or the ability to pair program with someone through a sticky bit of code, I am missing something in my work life, and I wonder if anyone else is in the same place?

Obviously lockdown hasn't helped, so I wonder if there is anyone on this subreddit that would be willing to set up a more informal chat to dip into throughout the day? It would be great to be able to pair on problems together or just run ideas past each other. If nobody's interested, or this is the wrong place to ask, then I accept my downvotes... but if anyone else feels the same, please reply!

I'm asking in PHPHelp because the main thing I miss is talking on-topic with PHP/web related chats. Most other contacts I have have either strict non-disclosure agreements or don't work with PHP.

Cheers,

Greg.

On the project I'm building I've had a requirement to communicate with multiple devices via persistent http connections and also receive and send websocket messages.

I didn't think PHP was capable so my automatic reaction was to use NodeJs (ElectronJs) with TypeScript. Long story short - it was not a fun experience. I got the app working just fine and relatively quickly too, but the developer experience was bad and I realised I didn't enjoy working on the project.

A month ago, after 3 months of work on the NodeJs version, I decided to throw in the towel and try to rebuild it in PHP and this is when I discovered ReactPHP.

I'm using it's event loop to create the persistent HTTP connections. My two streams are receiving events just fine. I'm using Ratchet in the event loop to connect to my websocket server to listen for and send messages.

I'm using periodic timers to execute some polling type actions. And Guzzle to send post/get/put requests.

It's all working flawlessly and it has been a joy to build, improve and expand.

What's the deal with ReactPHP? Why is it not used more? Am I going to discover something down the line I should know now - why do people reach for Node when seemingly ReactPHP can do it well?

Are there any disadvantages or pitfalls I'm going to discover down the line?

And, if anybody knows how it works, I would be interested to know. Why do people ask for async features when they are available through a tool like ReactPHP?

Hey all,

I've been a developer for 18 years, and I've been working with PHP pretty much exclusively for the past 6 years.

I see a general distaste for PHP from a lot of people in tech, and I get it, a language that started off as procedural and super loosely-typed has morphed into an increasingly strongly-typed, object oriented language, meaning PHP has lots of idiosyncrasies in comparison to languages that started out and stayed as strongly-typed OO, such as Java. This change has made PHP upgrades probably more challenging than they would be otherwise with other languages.

That being said, I don't hate PHP, I've done some pretty damn cool things with it, both web-facing things and more back end/ETL-oriented things.

My company recently brought on someone as a new CTO who has strong opinions about what should be used vs what shouldn't be used, despite not having worked directly in code for a long time. PHP is definitely on his "shouldn't be used" list. I've discussed this with him before and pointed out that it's not so much the language that's bad, it's how it's used - I've seen bad Javascript, Node, Java, C, shell, Perl, etc. It's clearly not the language that's at fault, but it's how it was used. And to be fair my company has some pretty horrible usage of PHP in a lot of places. We began as a startup with a LAMP implementation and a lot of nasty decisions were made, but we're working to rectify that.

Before he was brought on, I built the framework for a sort of ETL tool to support integration with a 3rd party. I used PHP because our devs know it and bringing on some other language at the time would be difficult for our devops team to support. We're now in a position where we want to support more integrations with this third party, as well as with new integrations for other third parties. Naturally, my plan was to reuse and build on what I've already developed, but he thinks that PHP can't support things other languages can (like async web requests - php does obviously) and he's said "I've never heard of an ETL tool built in PHP". Obviously this has been done, otherwise projects like Flow PHP wouldn't exist and be as mature as it is.

He wants to basically leave what I have in place for the existing integration, but build out a brand new ETL/integration service in Node.js/TypeScript and try to move everything to that, solely because he doesn't think PHP is capable and he can't hire PHP talent that would know what to do with it. Based on my experience and recent posts I've seen here, I think he's completely wrong on both counts.

It should be called out this guy has never coded PHP in his life, so he is coming from a fairly uninformed position. That being said, should PHP be avoided for ETL-type workloads? Does this guy have a point?

If your file ends with PHP, don't close the tag eg. ?>

It's a pet peeve of mine. Errant white space or new lines will cause errors with headers, best not to close it.

https://www.php-fig.org/psr/psr-2/#22-files

Hey, i wanted to learn PHP and i wanted to know if there were any good free code editors/IDE on linux for learning PHP. Thanks in advance.

I know there are many frameworks, like Laravel, Symfony, and Slim, but which ones are better for finding a job? As far as I know, Symfony is more difficult compared to Laravel. Are there any other frameworks I should consider?

I've seen several posts in this forum, and other similar programming subreddits, where OP's are blatantly offering (albeit tiny) amounts of money to those who are willing to complete assignments for them.

There are a number of people (including myself) who respond in a (what I feel is an) appropriate fashion - explaining that cheating is rarely the way forward, and those who do it don't learn anything from simply paying someone else to complete their assignment for them.

Having said this, there are also some who ask questions like "how much are you willing to pay?" or "I can complete the assignment for you, but if you want tutoring - look at YouTube..."

This shouldn't be a thing.

We, as a community, should be encouraging those who ask questions to seek answers encourage them to learn - not seek to profit from them. We should be educating those who need help that the path to understanding their problems are not to have someone code them for them, but to logically break down their issues into smaller units, for ease of solving.

Communities like StackOverflow actively enforce policies like this (actually, StackOverflow is much stricter!), so why can't we make a conscious effort to take more of an educational route like they have? Is it really that hard, Reddit?

/rant

Hello everyone, I decided to provide as much value as possible to everyone, so I decided to create discord where I can help beginners build their first project so they can reach their goals.

https://discord.gg/nfQq7rHTv9

Motivation: I thought that If something happens to be one day, my knowledge will come with me, so I decided to share it everywhere and how I can.

Hi

Imagine I have a small IF condition (if (2 ==2)) and I want to output 2 things based on the result. I can either echo out the HTML (code 1 below) or just drop in and out of PHP so there is no echoing (code 2 below).

Two issues I can think of is that Code 1 is more prone to errors (mistyping, missing closing or opening PHP tags, etc), and even though in this case Code 2 looks cleaner, writing a few hundred lines of HTML inside echo would be pretty messy.

Is there any advantage or disadvantage?

Thanks

Code 1 (in and out of PHP)

<?php
if (2==2) { ?>
	<p>Same</p>
<?php } else { ?>
	<p>Not the same</p>
<?php } 

Code 2 (always in PHP)

<?php
if (2==2) { 
	echo '<p>Same</p>';
} else {
	echo '<p>Not the same</p>';
}

https://www.php.net/archive/2026.php#2026-10-20-1

I know it’s not a help post, but an FYI for those who haven’t seen this.

Hey everyone! 👋
I'm starting to learn PHP and would love to hear the community's advice.
What do you recommend I start with? Any good resources, practices, or beginner projects you suggest?

Thanks in advance! 🙏

I know for a fact that my teacher wrote the course material 20+ years ago. I don't trust his qualifications or capabilities at all. For these reasons, I'd like the input of people who actually use PHP frequently. Is it done that devs keep PHP and HTML apart in separate documents at all times? If not, why not?

Edit: Thanks all for the replies. The general consensus seems to be that separating back-end logic and front-end looks is largely a good idea, although this is not strictly speaking what I was trying to ask. Template engines, a light mix of HTML and PHP (using vanilla PHP for templating), and the MVC approach all seem to be acceptable ways to go about it (in appropriate contexts). As I suspected, writing e.g. $content amongst HTML code is not wrong or abnormal.

I have a grand total of 3 months of work experience. I was a jr-jr laravel dev back then and I knew pretty much nothing except connecting a route to a view through a controller. Nowadays I mainly work on my own projects and have some freelance gigs from time to time with laravel.

The thing is; I can build things. I am at a point where I can build pretty much anything there is to build with laravel. But I'm definitely not a professional. I don't write tests for example. So far I've built many laravel apps and never written a test in my life. I don't know what service container means, I tried to use websockets once and I failed miserably. And these are only the things that I know that I don't know.

I wasn't even looking for a job but apparently my father told his friend about me and he had a friend who were looking for a backend developer. From what I understood from the 10 minute WhatsApp call interview-like thing I had with the guy, they're a company that makes mobile games and they're using PHP/laravel as backend.

He asked me "let's say I have a script for a lotto game written in Laravel, would you be able to understand and edit the code?" And I said "I can write a lotto game from scratch with Laravel in less than a week". So cringe, I know. I wanted to kick myself as soon as those words left my mouth. But apparently that was exactly what he wanted to hear, because he said that me saying that assured him and that he'll talk to the ceo and get back to me tomorrow, and because I said that, he thinks "it'll most likely be positive".

I am wide open to any suggestions you have. But my main question is; I've followed a ton of Laravel tutorials and none of them taught me about any questions I've seen on laracasts or web development subreddits (tests, service containers, providers, sockets etc.) and I feel like none of those courses are enough to help me get a job because of that. I mean how can you be a "professional Laravel developer" if you don't even know how to write a test? Pitying myself aside, a course link, book or YouTube channel name, literally anything is much appreciated. Thanks.

I've worked in the PHP ecosystem for years and really love it. But I feel like I don't know it deeply...

What separates posers like me from the guys at the PHP org who release features? How do I get there (or 1/4 of the way)?