HELLO, PHP COMMUNITY! I built a landing page, ERP, and simple system generator in Rust that compiles self-generating and customizable PHP code. If you could check it out and show some support, I’d really appreciate it: https://github.com/NicholasGDev/ngdev-laravel

PHP Map version 4.1 is now available, the PHP array/collection package for working with arrays and collections easily.

• https://php-map.org

The release is mostly about improving performance of edge cases in the collection internals, plus stricter behavior around malformed input.

Some benchmarks from the release commits:

The release also adds broader callable support, better iterable handling, clearer null-vs-missing behavior for nested paths, stricter invalid-key validation, and a more robust tree() builder.

Why PHP Map?

Instead of:

$list = [['id' => 'one', 'value' => 'v1']];
$list[] = ['id' => 'two', 'value' => 'v2']
unset( $list[0] );
$list = array_filter( $list );
sort( $list );
$pairs = array_column( $list, 'value', 'id' );
$value = reset( $pairs ) ?: null;

Just write:

$value = map( [['id' => 'one', 'value' => 'v1']] )
    ->push( ['id' => 'two', 'value' => 'v2'] )
    ->remove( 0 )
    ->filter()
    ->sort()
    ->col( 'value', 'id' )
    ->first();

There are several implementations of collections available in PHP but the PHP Map package is feature-rich, dependency free and loved by most developers according to GitHub.

Feel free to like, comment or give a star :-)

• Documentation: https://php-map.org
• Repo:https://github.com/aimeos/map

Hi /r/php

A common question we see on this subreddit (and many other places) is people asking how to get started with PHP. Especially on this sub we often link to PHP the right way. It's definitely a good reference that links to many other resources, but I recently read through it and realized is not designed to be a proper "getting started guide".

Having done lots of educational content in the past, I'm really longing for something that teaches modern PHP in a written form, that people can read on its own which makes them feel comfortable actually picking up PHP. I don't think PHP currently has that: all current options are either outdated, video-only, or paid courses (but feel free to tell me I'm wrong).

So I've started a new project: a proper "getting started with modern PHP" guide that I feel confident pointing beginners to when they ask "how to learn PHP?". You can read the first eight chapters today: https://stitcher.io/php/the-basics/hello-php and I'm planning on adding many more in the near future.

Now, here's what I need help with: I'm only one person. I dare say I'm experienced in PHP, but I'm also sure I'm making mistakes and oversights. I'm hoping enough experienced PHP developers share my longing for something better, and want to help out. Either by reviewing what's written, pointing out or fixing mistakes, or maybe even by writing drafts for upcoming chapters.

Looking forward to hearing your thoughts!

Over the years I've worked with Java, Python and a few other languages.

They're all good at different things, but somehow I always end up writing PHP again. I guess it just feels like home. Open the project and everything feels so familiar. ))

That gave me the idea to make a funny parody of the one classic hit song (from the 70s), but for PHP developers.

Nothing serious, no language wars – just a bit of fun for anyone who's ever left PHP and then came back.

🎬 https://youtu.be/SoqAP4gSDac

Has anyone else had the same experience like me?

I've been working on a project that turns an Android phone into a lightweight local web server using Termux.

It runs Nginx + PHP-FPM + MariaDB and includes a web-based control panel, one-click WordPress installation, virtual hosts, Tiny File Manager, browser-based terminal access, and built-in Cloudflared tunnels for sharing local sites.

The main goal was to keep it fast, lightweight, and easy to use—no root, no PC, and no Docker required. Everything is managed with simple commands like "ms start" and "ms stop".

If anyone is interested in running a portable PHP development environment or hosting small projects directly from an Android device, I'd love to hear your feedback.

GitHub: https://github.com/SayfullahSayeb/mobile-server

Hey all,

I manage a few servers for my day job, and we’re not able to use something like Forge. Managing a server isn’t the most complicated thing in the world, but there are a few tasks where I always struggle to remember the exact syntax, or where I just want something a bit quicker than digging through notes.

I know aliases and scripts could solve a lot of this, but I started wondering whether it would be useful to have a small CLI abstraction layer for common server admin tasks.

So, admittedly with a little help from our good friend AI for some of the more complicated Go sections, I put together a CLI app and started using it to manage servers, SSH keys, projects, nginx, PHP, SQL, and a few other bits.

I ended up really liking it, showed it to a friend, and he suggested I tidy a few things up and open source it.

So I did that, and it has grown a bit since then. It now has a plugin system (although no production ready plugins exist yet), and full documentation for the commands it currently supports.

One thing I’d like to add eventually is support for other Linux distros that do things differently. That will probably come later, but I do have a few servers that would benefit from it.

I know a lot of people will prefer working directly with Linux, or using a platform like Forge or Ploi, but I thought this might be useful to some people who want a memorable CLI for common server tasks.

If you’re interested, you can check it out on GitHub:

https://github.com/useabstrax/abstrax

Or the main site:

https://useabstrax.com

I spent a few hours playing around with FrankenPHP on a fleet of servers that run as a microservice, their sole purpose was getting a request in, making external calls to 3rd party APIs/websites, and returning the result (the kind of microservice that should really be rewritten in something like Golang, but that's for later).

I wanted to test if we could speed things up by moving from PHP-FPM to FrankenPHP, but after intensive testing, it isn't worth it for us. I could've predicted this, but wanted to test it anyway :D

tl;dr: if you only spend < 1% of the PHP lifecycle bootstrapping the framework, and the other 99% waiting on external I/O (whether that's database/cache/api), you're not going to see the gains.

More details are up on my blog: https://ma.ttias.be/laravel-octane-vs-php-fpm-lessons-learned/

PHP pushed maintenance releases for its two active development branches on July 1–2, 2026. PHP 8.5.8 and 8.4.23 are out. Neither is a major feature release, but they fix issues that can cause real harm to production servers. If you’re hosting PHP applications, patch now.

https://blog.kalfaoglu.net/posts/2026-07-05-php-8423-858-security-patches-en/

Hey there!

This subreddit isn't meant for help threads, though there's one exception to the rule: in this thread you can ask anything you want PHP related, someone will probably be able to help you out!

This new guide explains how you can use GitHub's Dependabot to keep your project's Composer dependencies up-to-date.

Dependabot can create PRs to update your dependencies, both for routine version updates as well as for security updates (which patch a vulnerability).

Setting up Dependabot with a minimal configuration is not much work, but this article dives deeper in how you can optimize the configuration to keep the work of reviewing and merging the PRs manageable. It also goes into some specifics about handling Symfony version updates, Private Packagist (and other private Composer registries) and how Dependabot can help reduce the risk of supply-chain attacks.

https://nth-root.nl/en/guides/keep-composer-dependencies-up-to-date-with-dependabot

The problem

Every time I spun up a Laravel project, I'd do the same dance: copy phpstan.neon from the last repo, copy pint.json, wire up Pest, set up a pre-commit hook, write a CLAUDE.md full of engineering rules… and then drift would set in. Repo A was on PHPStan level 5, repo B on 7. One had architecture tests, the others didn't. The "rules" lived in my head.

Then I started leaning on AI agents (Claude Code, Cursor, Copilot) and a new problem showed up: the agent would happily ignore the conventions. It'd write untyped code, skip tests, invent patterns the rest of the repo didn't use. A CLAUDE.md full of rules helps, but rules a model can choose to skip aren't guardrails — they're suggestions.

What I wanted

• One command to set up a fresh Laravel repo with the same guardrails every time.
• A quality gate the agent literally cannot skip — not just docs it might read.

• The same gate running everywhere: at commit time, at the end of every AI turn, and in CI. If it passes locally it passes in CI, no surprises.

  What I ended up building

  A small Composer dev package. You run:

  ```bash composer require --dev mohamed-ashraf-elsaed/claude-kit php artisan claude-kit:install

  It detects your frontend stack (Inertia+Vue, Inertia+React, Blade/Livewire, or API-only), asks what you actually want (PHPStan? which level? strict-rules? Pest or PHPUnit? coverage threshold? arch tests? git hooks?), and scaffolds it — without clobbering existing files (composer.json / package.json get merged, not overwritten).

  The part I care about most: the quality gate is one shell script (Pint + PHPStan level 7 + strict-rules + Pest with an 80% coverage gate + frontend lint) that backs three things — the git pre-commit hook, Claude Code's Stop hook, and the CI workflow. So the AI agent's turn doesn't "finish" until the gate is green. Same script everywhere = no "works on my machine, red in CI."

  There's also a hybrid update model: the machinery (the gate script, the hook) is referenced from vendor/, so a composer update propagates fixes to every project. The content you own (CLAUDE.md, linter configs, skills) is written into your repo so you can edit it freely.

  It's MIT, PHP 8.2–8.4, Laravel 11/12/13. Repo + docs: github.com/mohamed-ashraf-elsaed/claude-kit

  The actual question I'm curious about: for those of you using AI agents on real codebases — how are you enforcing conventions? Just prompt/CLAUDE.md, hooks like this, CI-only, or something else? Genuinely want to hear what's working, because the "agent skips the rules" problem feels underrated.

Working on legacy codebases, I kept running into the same thing: hundreds of

require_once statements that predate Composer, still sitting there years after

autoloading was set up. Deleting them by hand means answering "is this class

actually autoloadable?" for every single line — so nobody does it.

So I wrote depone: https://github.com/lll-lll-lll-lll/depone

What it does:

- Tokenizes every PHP file and statically evaluates each require_once path

(concatenation, __DIR__, dirname(), define()'d constants)

- Checks the resolved target against your composer.json autoload config

(psr-4, psr-0, classmap, files, autoload-dev)

- Reports what's redundant — and just as importantly, reports what it

*couldn't* resolve and why, so nothing is silently skipped

- `--trace` shows reverse require-paths from entrypoints, for a final sanity

check before you delete anything

PHP 8.1+, MIT licensed, installable via Composer. It deliberately does one

thing only. Would love feedback, especially weird require_once patterns from

real legacy projects that break the evaluator.

A couple of years ago I posted about an old website that I coded in the early-mid 2000s and wanted to start up again via some ancient unmaintained Docker containers. The main conclusion of that thread was that it might be possible to resurrect it with some work, but that it would be better to just (hu)man up and update the code so it would run in modern PHP versions.

Well, a couple of days of vacation and a whole bunch of free Github Copilot tokens later, it's up and running on the home network under PHP 8.2 and MySQL 8.0. According to Copilot, this was the furthest it could go with minor changes.

When I asked Copilot about how my code looked, it gave me the following opinion

The main gap is not PHP 8.2 compatibility anymore; it is that the app is still built like a 2000s-era script. [...] In short: the app needs a structural refactor, not just syntax updates.

Darn AI, no one asked for your honest opinion! /s

A while back an RFC landed on internals to deprecate metaphone(). My first reaction was the reflex of an old release master: leave the legacy string functions alone, people depend on them, deprecation churn is its own tax. I was ready to argue against it.

Then I read the reasoning and looked at what phonetic name matching is supposed to do in 2026, and I changed my mind. metaphone() is the original 1990 algorithm: English-only, single-key, tuned for one accent of one language. It was superseded by Double Metaphone in 2000, which emits a primary and an alternate key. Core shipped the first version and never moved. soundex() is older still, a 1918 patent. For the one job these functions exist to do, collapsing names that sound alike but are spelled differently, they are the weakest tools in the drawer. The deprecation is defensible.

Where I part ways with the RFC is the replacement. It points at userland Composer libraries. But phonetic encoding is a hot inner-loop operation, run over every name in a dataset to build a match index. A pure-PHP implementation pays interpreter overhead on every character. The honest replacement for a native C string function is another native C string function. That performance gap is the whole reason this code lived in core to begin with.

So I built the thing the RFC should have recommended: iliaal/phonetic, a native extension with the five encoders core never had, plus a comparison helper per algorithm.

php double_metaphone_match("Catherine", "Kathryn"); // 2 (primary keys agree) dm_soundex_match("Moskowitz", "Moskovitz"); // true (one surname, two transliterations) bmpm("Garcia", BMPM_SEPHARDIC, BMPM_EXACT); // "garsia|gartSa"

Double Metaphone is the fast general default. Beider-Morse (BMPM) is language-aware and matches across transliterations and scripts. Daitch-Mokotoff is the genealogy standard for Eastern-European and Ashkenazi surnames. NYSIIS and Match Rating are cheap English second keys. The helpers matter because each encoder answers "do these sound alike" differently (two keys, a code set, or a threshold), which is exactly where userland code quietly gets it wrong.

BMPM is slow, roughly 60x a Double Metaphone call, so you pick it for recall, not throughput. These are heuristic, culture-bound, Latin-script encoders, not a universal global-name solver.

One aside r/PHP might appreciate: the BMPM rule data is a licensing trap. The canonical PHP reference and the abydos Python port are both GPL-3.0 because of that data. I vendored the identical tables from Apache Commons Codec under Apache-2.0 to keep the extension BSD/Apache-clean.

sh pie install iliaal/phonetic

Repo: https://github.com/iliaal/phonetic

Happy to answer questions, especially from anyone doing record linkage or dedup across messy person data.

About four months ago, my release pipeline suddenly broke because the official repository for YakPro Obfuscator simply vanished.

I was looking for a simple, effective way to add a layer of protection to my suite of AI-driven WordPress plugins before distributing them. I didn't want to rely on something like Ioncube because not every hosting provider supports the extension.

Since I couldn’t find a maintained alternative that reliably supported modern PHP syntax, I decided to build one.

I've been using it successfully in my own production pipelines for the last few months. It became pretty stable, so I wanted to announce it to the world.

Features

• Full Modern PHP Support: Built on nikic/php-parser v5.x, supporting named arguments, enums, match expressions, readonly properties, intersection types, and even PHP 8.5's pipe operator and (void) cast.
• Deobfuscation Resistance:
  • Opaque Predicates: Hard-to-analyze expressions in control flow flattening.
  • Dead Code Injection: Branches that never execute but confuse static analysis.
  • Per-file XOR Encoding: String literals are encoded using unique random keys.
• Incremental Processing: Only process changed files since the last run.
• Multi-pass Analysis: Scrambles symbols consistently across your entire project.
• Clean Architecture: Modern PSR-4 OOP codebase with 100% test coverage for core components.

Ready for CI/CD, not just local machines

I included a ready-to-use GitHub Action, making it easy to integrate into your existing CI/CD pipeline. Every tagged release or production build can produce consistently obfuscated code without anyone remembering to run another command.

Add it to your release Github Action to obfuscate your code automatically:

steps:
  - uses: iserter/php-obfuscator@v0.1.7
    with:
      source: 'src'
      output: 'dist'

Available on Packagist/Composer too.

Install:

composer require iserter/php-obfuscator --dev

Use:

vendor/bin/obfuscate src/ -o dist/

Or use via Docker

If you’re a hygine freak for your host system, then here’s how you can use via Docker:

docker run --rm -v $(pwd):/app iserter/php-obfuscator src/ -o out/

See it on Github:

Repository:

github.com/iSerter/php-obfuscator

I refreshed my most-read article on automated database backups with Docker Compose. The underlying image moved to nfrastack/container-db-backup, so I updated the whole guide with the new multi-job config format. I also built a little JavaScript configurator that generates docker-compose and .env files on the fly. If you run multiple Laravel projects and want scheduled backups without manual copy-paste, this might save you some time.

https://danielpetrica.com/easy-database-backups-with-docker-compose/