Php on Murat Useinov

Reading PHP 8.6 RFCs as constraints

Mon, 17 Aug 2026 21:05:00 +0300

Accepted, declined, discussion drama. That is how most posts about PHP 8.6 RFCs read, and the vote cycle is in full swing this month. I read RFCs for a different reason. Not “what do I get”, but “what will my current code look like next year”.

One RFC is a feature. Ten RFCs are a direction. When several push the same way, toward stricter types, explicit declarations, deprecating some old freedom, the direction tells you which of your habits are becoming legacy while you still type them. Syntax sugar is the least interesting part. Deprecations are the most interesting, because every deprecation is a migration with a countdown attached.

Dependency upgrades without a big bang

Fri, 27 Feb 2026 19:45:00 +0300

A composer.lock that had not changed in three years. A colleague showed it to me last week, not as a confession, as a normal fact about the project. Nobody decided this. Every single upgrade looked small and risky, so everybody postponed it. Three years of postponed small risks equals one migration project with a budget and a name.

The alternative is dull and it works. Upgrades as normal operations, like backups.

PHP 8.5 one month later

Mon, 19 Jan 2026 21:50:00 +0300

Last week of December, low traffic, good test suite. That is when we moved one project to PHP 8.5. Not brave, convenient. A month later I can sort the release into two piles.

Pile one is the demo features. Every release has them. They look great in a tweet-sized example, then you search the codebase and find two places to use them. Fine. Not why you upgrade.

Pile two is the boring changes. Less boilerplate in places you touch every day. Types that say what a function really returns. Small things that make PHPStan complain earlier instead of production complaining later. This pile is why you upgrade, and you only see it after some weeks, never in the release notes.

From Kohana to PHP 8.5

Thu, 11 Dec 2025 21:40:00 +0300

A Kohana ORM, an N+1 on a catalog page, and a blog post about it. That was November 2014. It is December 2025, the code around me runs PHP 8.5, and I went back and read that first post.

The surface changed completely. A 2014 controller was a fat method: it read the request, validated by hand, called the ORM, formatted the response, sometimes sent an email on the way out. Types lived in docblocks and in hope. Deploy was files over FTP and a prayer. Today the same feature is a typed handler with constructor injection, validation at the boundary, a use case object, a message on a queue for the email, a trace id through the whole thing. The engine checks what a comment used to promise. I do not miss the old way.

The November upgrade train

Fri, 21 Nov 2025 22:30:00 +0300

PHP 8.5 came out yesterday. Symfony 7.4 LTS and 8.0 land at the end of the month, same as every year. November is upgrade month now. First the cargo, then the timetable.

From 8.5 I care about three things. The pipe operator makes transformation chains read left to right:

$slug = $title
    |> trim(...)
    |> strtolower(...)
    |> (fn ($s) => preg_replace('/\s+/', '-', $s));

The new URI extension puts standards-correct URL parsing in core. parse_url had opinions instead of a specification, I will not miss it. And #[\NoDiscard] lets a method declare that ignoring its return value is a bug. Made for result-style APIs, where a dropped return is a swallowed error.

Coding agents meet legacy PHP

Fri, 10 Oct 2025 21:30:00 +0300

A strange-looking condition in a 2015 module, “fixed” by an agent. All tests green, static analysis clean, and the condition was a business rule with history. My review caught it. Barely.

That came out of an experiment I ran this month: a coding agent on one legacy PHP module, since agents can do multi-file changes now and every old codebase suddenly looks like a target.

The setup matters more than the model. I did not ask “modernize this”. I gave a narrow migration goal on one bounded module: replace a deprecated API, add proper namespaces, keep behavior. The same shape of task I would give to Rector. The difference is that the agent also handles the irregular cases Rector cannot express, the places where people wrote creative code in 2015.

vendor/autoload.php is not free

Wed, 20 Aug 2025 20:10:00 +0300

46 milliseconds. That is how long the bootstrap of one large application took before the framework even started, in a trace I pulled this week. A good share of it was autoloading.

require vendor/autoload.php looks like a constant of nature. With plain PSR-4 rules it is a loop: every class load walks the prefixes and asks the filesystem whether a file exists. A few thousand classes on a cold request, and the loop becomes a number you can see in a flame graph.

Symfony 7.3 and the code I get to delete

Fri, 30 May 2025 15:25:00 +0300

Symfony 7.3 was released this week. I opened the release notes with a text file next to them. The file is a list of things to delete.

Every project older than three years carries a layer of custom helpers that were reasonable when written. The framework moves, the helpers stay. Nobody reviews them, because they work.

Two examples from one project.

A base console command class with sugar for arguments and options, written around 2021. Symfony 7.3 has invokable commands, arguments come as parameters with attributes:

Native lazy objects, the ORM view

Wed, 09 Apr 2025 22:35:00 +0300

Open the Doctrine proxy folder of any project older than a year. A generated subclass for every entity, getters overridden, one file per class in the cache dir. It worked for fifteen years, and the seams always showed: final classes, public typed properties, instanceof surprises, a folder of code you pretend not to see.

PHP 8.4 lazy objects were designed with exactly this in mind. The native way needs no generated class:

Laravel 12 is a boring release

Wed, 26 Feb 2025 23:30:00 +0300

Laravel 12 came out on Monday. Tuesday evening I upgraded one mid-size project. The whole diff is composer constraints and the lock file. Tests green, deployed before midnight.

People in chats are disappointed. Where are the big features. A major that mostly refreshes dependencies and starter kits, is it even a major.

I remember 4.2 to 5.0. New folder structure, new config system, half of the packages dead on arrival. We planned it as a separate project, because it was one. Skip a major, and the next one cost double.

PHP 8.4 after the hype

Wed, 15 Jan 2025 15:50:00 +0300

A private field, a getter, a setter with one line of normalization. Three members for one idea, repeated through every entity folder I have ever opened. PHP 8.4 is two months old, the conference demos are done, and the honest question is which features earn a place in a working codebase.

My filter is simple. A feature is good when it deletes code.

Property hooks pass:

class User
{
    public string $email {
        set => strtolower(trim($value));
    }
}

The class is shorter and the normalization cannot be bypassed. But keep hooks boring. A hook that talks to the database is a magic getter from 2008 in new syntax.

Lazy objects move into the engine

Sat, 23 Nov 2024 12:50:00 +0300

Fifty ghosts initialized in a loop are still fifty one queries.

PHP 8.4 is out since Thursday. Property hooks get the headlines, but the feature I keep coming back to is native lazy objects. It legalizes a trick ORMs have done with generated code for fifteen years.

The trick: you load an order, $order->customer should be a Customer, and you do not want a query until someone actually touches it. Doctrine generates a proxy class at build time, a subclass that overrides every method with “initialize first, then call parent”. It works. It is also a pile of magic: generated files, edge cases with final classes and private properties, strange things in var_dump.

Property hooks, before the hype settles

Mon, 14 Oct 2024 20:50:00 +0300

Six lines of getter and setter ceremony around one strtolower. PHP 8.4 is in release candidates, and property hooks delete exactly that:

class Customer
{
    public string $email {
        set => strtolower(trim($value));
    }
}

Assignment stays assignment, $customer->email = $input, and normalization happens on the way in. For this exact case, one value, no dependencies, I am convinced. The property remains a property.

Where I get careful is everything past normalization. A setter method is ugly, but it announces itself. setEmail() in a call stack tells you code ran. $obj->email = $x looks free, and with hooks it is not. Put validation that throws into a hook, and every plain assignment becomes a possible exception, invisible at the call site. Put a side effect in, and you have built magic the next person discovers through a debugger at midnight. We spent years removing __get and __set from codebases for this exact crime. Hooks are their respectable cousins, better typed, analyzable, and the temptation is identical.

Pick the library with a profiler, not a chart

Wed, 07 Aug 2024 20:50:00 +0300

Two hundred thousand ops per second against eighty. That was the bar chart, and the team was ready to pick a serializer from it. I asked for one day.

The day went like this.

Take a representative workload. Not a synthetic three-field object, but a hundred real payloads from production logs, with the nested structures, the nullable mess, the one field that is sometimes a list and sometimes a map. Anonymize them, save as fixtures. This step is the whole method. The bar chart was measured on someone else’s data with someone else’s configuration, and a serializer is exactly the kind of code whose cost depends on the shape of the input.

A faster sprintf will not fix your p99

Tue, 18 Jun 2024 23:15:00 +0300

Three times faster. That is the number in the benchmark posts about PHP 8.4, where simple sprintf() calls with basic placeholders get turned into plain string operations at compile time. The function call disappears.

for ($i = 0; $i < 1000000; $i++) {
    $s = sprintf('%s-%d', $prefix, $i);
}

I like this work. I do not like how people read it.

A microbenchmark measures one function in a loop, alone, with a warm cache and nothing else to do. Now profile a real request from the same application. In every backend I have profiled the picture has the same shape: most of the wall time is waiting. SQL queries, Redis round trips, an HTTP call to some partner API. The CPU spent inside PHP is a modest slice, and sprintf inside that slice is a rounding error. Three times faster rounding error is still a rounding error.

One trace through HTTP, queue and database

Thu, 08 Feb 2024 19:50:00 +0300

A request creates a job. The job calls an external API and writes to the database. Something in this chain is slow, and the logs tell four disconnected stories.

Grepping a request id across services is our folklore. OpenTelemetry finally makes the boring standard version practical in PHP.

The core is small. One trace id for the whole causal chain, a span id for every operation, and one rule: pass the context along. Over HTTP it is a single header:

AI assistants do not know your production

Sat, 23 Dec 2023 10:40:00 +0300

A DTO with a dozen fields, a framework migration, a slow query incident. Three tasks from the last few months, all done with Copilot and ChatGPT open. Here is where the line runs for me.

Task one, boilerplate. The DTO, its validation rules, a test with fixtures. The assistant writes this faster than I type, and the result needs only a quick read. Same for converting an array-shaped legacy structure into typed classes. This is honest time saved, maybe an hour a day. The code is the kind where being generic is correct.

PHP 8.3 and Symfony 7 in one month

Thu, 30 Nov 2023 10:45:00 +0300

public const int TIMEOUT_SECONDS = 30; One week old, and the one thing I waited for from PHP 8.3.

Busy November. 8.3 released last week, and yesterday Symfony shipped 6.4 LTS and 7.0 on the same day. Time to plan, not to jump.

Typed class constants are a small thing, but constants were the last untyped island in a class, and a child class could silently redefine one to a different type. Also json_validate(), which checks JSON syntax without building the whole tree in memory. Everyone had a helper that did json_decode and threw the result away. Now the helper can retire.

FrankenPHP: the server absorbs PHP

Fri, 27 Oct 2023 18:25:00 +0300

One binary, my code, a Caddyfile. That is the whole deployment of a small internal service I moved to FrankenPHP in staging this week.

The classic PHP deployment is a couple: Nginx in front, PHP-FPM behind, FastCGI between them. Two configs, two processes to supervise, one socket to misconfigure. It works, we all know it by heart, and knowing it by heart is the only reason we call it simple.

Persistent PHP workers need discipline

Mon, 03 Apr 2023 15:45:00 +0300

A static array with the comment “cache, cleared per request”. It went to production on RoadRunner last month, and the memory graph turned into a staircase.

PHP had one superpower nobody advertised: the request died. Every leak, every forgotten static, every open transaction was erased when the process shut down. Shared-nothing was not architecture. It was amnesia, and amnesia forgave us everything.

RoadRunner and Swoole take it away. The worker lives for thousands of requests, and the class of bugs changes on the first day. That “per request” cache became a cache per worker lifetime, and the supervisor killed the process when it ran out of memory. A logger kept the request id in a property, so entries from user B carried the id of user A. And the best one: an exception in the middle of a Doctrine transaction left the connection with the transaction open, and the next request on that worker silently joined it.

DI attributes: config moves into the class

Mon, 27 Mar 2023 23:10:00 +0300

Three lines of YAML in a file two directories away, for one integer that one service reads. That was the first thing I converted when I started moving a project’s service config from YAML into attributes, to see where the line is.

public function __construct(
    #[Autowire('%env(int:IMPORT_BATCH_SIZE)%')]
    private int $batchSize,
) {}

Now the class tells you everything about itself. Same with #[TaggedIterator] for collecting all implementations of an interface, and #[AsDecorator] for wrapping a service. These are local facts. A local fact belongs next to the code it describes. When I open the class, I want to stop searching.

Laravel 10 is a quiet major

Thu, 16 Feb 2023 20:40:00 +0300

Process::run('gzip -k dump.sql'). Out of the whole Laravel 10 release this week, that is the line I will actually use.

The rest is quiet. Skeleton and framework code got native type declarations instead of docblocks, PHP 8.1 is the floor, and there is the Process facade. That is roughly the whole story. Some people are disappointed. I am not. A major release that is mostly maintenance means the framework is an adult.

Before Laravel 10: raise the baseline first

Sat, 07 Jan 2023 22:40:00 +0300

composer why-not php 8.1. One command, and it tells you who holds you back. Run it before making any plans.

Laravel 10 comes next month and requires PHP 8.1. One project I help with is on Laravel 9 and PHP 8.0. The temptation is one heroic branch: new PHP, new framework, new package versions. When that branch breaks in production, you will not know which of the three changes broke it.

PHP 8.2: stricter by default

Fri, 16 Dec 2022 21:35:00 +0300

PHP 8.2 was released on December 8. My checklist for it looks like every other December, which is the whole point of a yearly cadence.

On the surface a quiet release. Readonly classes, DNF types, standalone true, false and null types, constants in traits. Underneath, the more important half: another round of cleaning old dynamic behavior. Dynamic properties deprecated, ${var} string interpolation deprecated, utf8_encode deprecated. The language keeps trading looseness for predictability, and I keep voting for the trade.

Readonly classes for value objects

Tue, 08 Nov 2022 22:45:00 +0300

Two readonly keywords for two properties in a two-property class. That is what an immutable Money looks like in PHP 8.1:

final class Money
{
    public function __construct(
        public readonly int $amount,
        public readonly string $currency,
    ) {}
}

PHP 8.2 is at release candidate stage, and the feature I am waiting for is this one. The keyword moves up and says it once:

final readonly class Money
{
    public function __construct(
        public int $amount,
        public string $currency,
    ) {}
}

Every property is readonly, and the class refuses dynamic properties on top. Cosmetics, yes. But cosmetics that make the right thing the short thing, and that changes what people actually write.

Dynamic properties are leaving

Sat, 03 Sep 2022 20:30:00 +0300

$invoice->totall = 250; One extra letter. No error, no warning. A second property appears, the real total stays null, and the bug surfaces three screens later as “total is empty sometimes”.

I have hunted this exact bug. Twice. Both times it took hours, because the write looks correct and the read looks correct. They just disagree on one letter.

PHP 8.2 lands in December, and the deprecation that will touch the most code is this one. Writing to an undeclared property becomes deprecated. In some future major it becomes an error. For fifteen years it was legal:

Fast query, slow endpoint

Tue, 23 Aug 2022 15:10:00 +0300

The profiler said the query takes 20 ms. The export endpoint took 900 ms and a quarter of a gigabyte of memory. The missing 880 ms was Doctrine turning five thousand rows into five thousand entities.

Hydration is not free. For every row the ORM builds an object, fills properties through reflection, registers it in the unit of work, creates proxies for relations. Per row it is nothing. Times five thousand, it is the endpoint. The profiler shows SQL because SQL is easy to show.

Laravel 9 and the boring major

Fri, 25 Feb 2022 12:50:00 +0300

One evening. That was the Laravel 9 upgrade on a mid-size project last week. Most of the diff was composer.json and a few config files.

Laravel 9 is out this month. Symfony 6 components under the hood, PHP 8.0 minimum, Flysystem 3. And from now on, one major per year. The upgrade guide is short, and the “high impact” section is shorter. This is a policy: small majors, often.

I want to defend this policy, because I remember the other kind. A project that sat on an old major for three years, because “we will upgrade when there is time”. There is never time. Then the version goes EOL, a security fix forces the jump, and you pay three years of drift in one horrible month. Packages you depend on drop support one by one, and suddenly it is not a framework upgrade anymore. It is archaeology.

Order status is an enum now

Sat, 08 Jan 2022 23:15:00 +0300

One row in orders had status 'canceled', with one l. Nobody knows how long it sat there. The enum found it on the first day.

PHP 8.1 enums are six weeks old, enough time in one project to say something practical. The first candidate was obvious: order status. For years it was a class with string constants, Order::STATUS_PAID, Order::STATUS_SHIPPED. Constants look safe, but nothing stops a function from receiving 'payed'. The parameter type was string, and string accepts everything.

PHP 8.1: enums, readonly and a word about Fibers

Fri, 26 Nov 2021 20:45:00 +0300

'payed'. One letter, half a day of debugging, a few years ago. The string walked straight through OrderStatus::isValid(), because someone had added it to the constants list “for compatibility”. Every project I touched has that class: a bag of string constants, an isValid() helper, and a prayer. The type system never knew these strings were special.

PHP 8.1 came out yesterday. Point release on paper, and it brings the feature I wanted since forever. Enums.

Generics we already have

Sat, 09 Oct 2021 20:05:00 +0300

A template calls getEmail() on an Order at three in the morning. The method returned array, the docblock said “array of User”, and eight months later someone put an Order in it. Everything was fine until it was not.

PHP still has no generics and will not get them soon. Meanwhile PHPStan and Psalm shipped them anyway, in docblocks. Checked at analysis, not at runtime. For everyday backend work that turns out to be most of the value.

Attributes in Symfony 5.3

Fri, 04 Jun 2021 21:05:00 +0300

#[Route('/orders/{id}')] right above the method, and nothing in config/routes. Symfony 5.3 came out last week, and with PHP 8 attributes configuration finally found its place. Routes, autowiring hints, some validation, native syntax next to the code:

#[Route('/orders/{id}', methods: ['GET'])]
public function show(int $id): Response
{
    // ...
}

I spent years defending YAML routing. The argument was separation: code is code, wiring is wiring, one file shows the whole URL map. The argument was never wrong. It lost to practice. In every real project the first thing you do with a route is jump to the controller, and the first thing you do with a controller is wonder which route hits it. Two files, one mental join, forever. Attributes remove the join. Rename a method, the metadata moves with it. Delete the class, no orphaned YAML block stays behind to confuse the next person.

Symfony Runtime: front controller as a callable

Fri, 16 Apr 2021 23:40:00 +0300

public/index.php, unchanged since I learned Symfony. Create the request from globals, run the kernel, send the response, terminate. Symfony 5.3 arrives next month, and the Runtime component rewrites this file. It looks like a small refactoring. It is a statement about where PHP is going.

Baked into those few lines is one big assumption: one process, one request, then we die. FPM made the assumption true for fifteen years, so nobody saw it as an assumption.

PHP 8 in production: dependencies first

Fri, 08 Jan 2021 23:20:00 +0300

composer why-not php 8.0. That is the first command of the migration, and it has nothing to do with syntax.

PHP 8.0 is six weeks old. Twitter is full of match expressions and constructor promotion. Meanwhile the real upgrade of a working project is a dependency problem. Your code is maybe twenty percent of what runs in production. The rest is the framework, thirty packages and a dozen extensions, and any one of them can be the blocker.

PHP 8.0: ignore the JIT, take the rest

Fri, 27 Nov 2020 21:25:00 +0300

JIT on, JIT off, the same Symfony endpoint. Difference within noise. Same for a Laravel endpoint. PHP 8.0 came out yesterday and this was the first thing I checked, because every headline is about the JIT.

Not a scandal. A web request spends its time in I/O, in MySQL, in framework code full of method calls the JIT cannot do much with. JIT is for tight numeric loops, and your controller has none. If you compute fractals in PHP, congratulations. The rest of us can leave it off.

Average response time explains nothing

Tue, 04 Aug 2020 20:40:00 +0300

Average response time: 180 ms. Ticket from support: “the API is slow”. Both true. The average is a diplomat. It offends nobody and tells you nothing.

Latency is a distribution. Our 180 ms hides a p50 of 90 ms and a p99 above four seconds. One request in a hundred is terrible, and with thirty requests per page load, most users hit that unlucky one regularly. The people complaining are not imagining things. They live in the tail, and the average never visits there.

PHP 8 will retire some of our workarounds

Fri, 03 Jul 2020 22:50:00 +0300

@param int|string $id. I grepped one service this morning: dozens of those, and every one is a wish. The docblock says what the signature could not. First alpha of PHP 8 came out last week, and native union types turn the wish into a contract, checked at runtime and by tooling. Half of my phpdoc can go.

Everyone writes about the JIT. I keep thinking about the less shiny thing: how many of our daily patterns exist only to compensate for a missing language feature, and are about to become legacy.

Types are for reading, not for the compiler

Sat, 27 Jun 2020 22:20:00 +0300

OrderRepository in a constructor. Click. I am there. That is how I explore a big Symfony project now, and I noticed my main reason for types has changed. Not bug catching anymore. Navigation.

Symfony 5.1 is out, PHP 7.4 is everywhere I work, and the IDE knows every caller and every implementation. Compare with the array-passing style we all wrote for years:

public function register($data)
{
    // what is in $data? read three call sites to find out
}

versus

Waiting for three APIs, one at a time

Tue, 21 Apr 2020 21:40:00 +0300

Three external calls on one page: prices, stock, delivery estimate. Each answers in about 300 ms. The page waits a full second, because we call them one after another. PHP is synchronous, what can you do.

Turns out, something. Symfony HttpClient is lazy. request() sends and returns immediately. The waiting happens when you read the response. So start all three, read later:

$prices   = $client->request('GET', $pricesUrl);
$stock    = $client->request('GET', $stockUrl);
$delivery = $client->request('GET', $deliveryUrl);

$data = [
    'prices'   => $prices->toArray(),
    'stock'    => $stock->toArray(),
    'delivery' => $delivery->toArray(),
];

Under the hood it is curl multi. Three requests fly at once, wall time is the slowest one instead of the sum. Our second became 350 ms. No swoole, no reactphp, no async rewrite. Same boring controller.

A Redis lock is a promise you cannot fully keep

Wed, 26 Feb 2020 21:45:00 +0300

Two workers, one order, processed twice. Every project gets this day. Someone writes SETNX, calls it a distributed lock, closes the ticket. I want to slow down here, because the ticket is not closed.

The small bugs first. A lock needs a TTL, or a crashed worker holds it forever. A lock needs an owner token, or worker A releases the lock of worker B:

$token = bin2hex(random_bytes(16));
$ok = $redis->set('lock:order:'.$orderId, $token, ['nx', 'ex' => 30]);

And the release must be atomic: compare the token and delete in one Lua script. Check in PHP, delete in a second command, and there is a gap. Something will land in that gap.

Static state outlives the job

Sun, 22 Dec 2019 23:50:00 +0300

One static array, from one of our projects:

class Settings
{
    private static $cache = [];

    public static function get($tenantId, $key)
    {
        if (!isset(self::$cache[$tenantId])) {
            self::$cache[$tenantId] = self::load($tenantId);
        }
        return self::$cache[$tenantId][$key] ?? null;
    }
}

A reasonable per-request cache. Under PHP-FPM it died with the process. In a queue worker it lives forever.

PHP had one great architectural feature nobody put in the manual: the process died after every request. Leak memory, cache nonsense in a static, forget to close things. Did not matter. The dying process forgave everything.

PHP 7.4: typed properties first, preloading later

Fri, 29 Nov 2019 15:25:00 +0300

Two lines of a class, and half of my docblocks can be deleted:

class Money
{
    private int $amount;
    private string $currency;
}

PHP 7.4 came out yesterday, and this is the part I start using on Monday. Those docblocks existed only to say @var int. Now the language says it, and unlike the docblock, it checks. Assign a string, get a TypeError at the assignment, not a strange bug three layers later.

There is one new state to learn. A typed property without a default is uninitialized, and reading it before the first write throws. This is the feature. “Object exists but is not filled yet” finally fails loudly instead of pretending to be null.

200 OK is not health

Wed, 07 Aug 2019 18:05:00 +0300

Route /health, returns ok, everyone happy. That is the first version of every health endpoint on the project we are moving to Kubernetes. Then somebody pastes the same path into livenessProbe and readinessProbe, and a thirty second database hiccup becomes a long evening.

The two probes ask different questions.

Readiness asks: should this pod get traffic right now. Here it is correct to check dependencies. Database unreachable, cache cold, migrations still running: answer no. Kubernetes takes the pod out of the Service, traffic goes to the others, the pod returns when the world improves. Failing readiness is cheap and reversible. A polite “not now”.

One use case, one class

Wed, 26 Jun 2019 15:30:00 +0300

Four hundred lines in a checkout action, half of them inside one try. That is one way a project dies. The other is OrderManager: thirty methods, six injected services, and nobody can say what the class is for, because it is for everything about orders.

Both diseases have the same cure and it is embarrassingly simple. One use case, one class, one public method.

final class PlaceOrder
{
    public function __construct(
        OrderRepository $orders,
        PaymentGateway $payments,
        EventDispatcher $events
    ) { ... }

    public function handle(PlaceOrderCommand $command): OrderId
    {
        // the whole story, top to bottom
    }
}

The shape answers three questions by itself. What comes in: one command object, a thing you can log, validate, put in a queue. What it needs: the constructor lists dependencies of this use case, not of orders in general, so when PlaceOrder suddenly needs the mailer you see it and can ask why. What comes out: one result. Reading handle() from top to bottom tells the whole story of placing an order. No chapter hidden in a base class or a trait.

PHP 7.3 and the value of small releases

Thu, 27 Dec 2018 15:35:00 +0300

A trailing comma after the last argument of a function call. PHP 7.3 came out at the start of the month, and this is the feature I noticed first, because I meet the missing comma in every second diff:

$this->logger->info(
    'order created',
    ['order_id' => $order->id],
);

A tiny thing that kills a whole class of noisy diffs, the ones where adding an argument touches the previous line too. Arrays got this years ago. Calls only now.

Rector: refactoring by machine

Thu, 08 Feb 2018 15:40:00 +0300

Search for ->fetch( in a project with old Kohana code and count the hits. A method call on a model, a comment, a line in a test fixture, an unrelated class that happens to have a method with the same name. That is what regex refactoring looks like. Regex does not know a method call from a string literal.

Rector does. A young tool I found this month: it parses PHP into an AST with nikic/php-parser, applies transformation rules, prints the code back. Rename a class across the whole project. Change a method call, add an argument everywhere. The AST sees that this fetch is called on that type and touches only those places. Mechanical change becomes exact.

Sodium in PHP 7.2 core

Sun, 10 Dec 2017 20:20:00 +0300

PHP 7.2 came out on the last day of November. Mcrypt is out of core, libsodium is in. That trade alone makes it a good release.

Search any forum for “php encrypt” and you find the same folk recipe: openssl_encrypt with AES-256-CBC, an IV made from who knows what, no authentication of the ciphertext. Every choice in that recipe is a place to be wrong, and CBC without a MAC is wrong in a way that has published attacks. The developer is not careless. The API hands an application developer decisions that belong to a cryptographer.

First run of PHPStan on legacy code

Sat, 09 Sep 2017 15:30:00 +0300

Level 0, a legacy codebase, a few hundred errors on the first run. That was my week with PHPStan. Most of the output was noise about magic the tool cannot see. But in the first hour of reading I found three real bugs, live in production for months.

One: a repository method returns an entity or null, and a caller chains a method right on the result. The not-found branch was never written. It survived because that path needs a deleted record, and deleted records are rare. Rare is not never.

PHP 7.1: nullable is honest

Fri, 09 Dec 2016 20:35:00 +0300

// returns User or false, see wiki
public function findByEmail($email)

Every legacy codebase has this method. The comment is the type system. Half the callers check for false, some check for null because a sister method returns null, one caller checks nothing and works by luck.

PHP 7.1 came out last week. Nullable types, void, iterable, multi-catch. Small features, but together they continue the direction 7.0 started: less implicit agreement, more signature. The one I care about is ?Type:

Doctrine and the 100 000 row import

Sun, 19 Jun 2016 20:35:00 +0300

Row sixty thousand. Allowed memory size exhausted. The import script on one project died there, and the code was the obvious loop: read a row, persist() an entity, next row, flush() at the end. On a hundred test rows it worked perfectly. It was my loop.

The reason is the Unit of Work. Doctrine keeps every managed entity in memory, plus a snapshot of its original data for change tracking. Persist a hundred thousand entities and you hold a hundred thousand objects twice. This is not a bug. It is the price of the ORM’s main feature, and on a normal web request the price is invisible because the request dies young.

Docker instead of a setup README

Wed, 13 Apr 2016 21:50:00 +0300

Two days. That is how long the new colleague spent last month getting one project to run on his laptop. The README is two pages: PHP with a specific set of extensions, Nginx, MySQL, Redis, and a paragraph that starts with “on OS X it is a bit different”. Every laptop in the team is a slightly different snowflake.

So I finally tried Docker for local development. The compose file:

Middleware groups in Laravel 5.2

Mon, 08 Feb 2016 21:10:00 +0300

An IP whitelist check placed after auth. That was the whole bug. Every scanner bot on the internet was going through session start and a user lookup just to be told to go away. The fix was to move one line up in the Kernel.

Laravel 5.2 makes that line easier to see. Middleware groups, and the request pipeline is finally written down in one place:

protected $middlewareGroups = [
    'web' => [
        \App\Http\Middleware\EncryptCookies::class,
        \Illuminate\Session\Middleware\StartSession::class,
        \App\Http\Middleware\VerifyCsrfToken::class,
    ],
    'api' => [
        'throttle:60,1',
        'bindings',
    ],
];

Before 5.2, sessions and CSRF were global middleware. They ran for everything, including API routes that have no use for cookies. Now web and api are two separate pipelines, and you can read each one top to bottom.

PHP 7 measured on real code

Sat, 26 Dec 2015 21:35:00 +0300

One endpoint. The heaviest catalog page of one project, same data, same opcache settings, PHP 5.6 against 7.0. That is the only benchmark I trust. 7.0 has been out for three weeks, everyone has seen the hello-world numbers, and I do not believe hello-world numbers on principle.

Response time dropped about 40 percent. Memory per request, more than half. No code changes. I ran it again because I did not believe the first numbers either. The engine rewrite is real: smaller internal structures, cheaper function calls, and typical framework code is exactly that, thousands of small calls and arrays.

Kohana on PHP 7: whose problem is it

Tue, 08 Sep 2015 10:45:00 +0300

The test suite went green on the PHP 7 release candidate on the second try. I expected worse. Then I opened modules/ and the mood changed.

The core mostly works. The community is patching compatibility in the 3.3 branch on GitHub right now, and the fixes are small: deprecated PHP 4 style constructors, changed engine behavior in dark corners. Whoever says the framework is dead is not reading the commit log. It is not dead. It is volunteers.

Run your tests on PHP 7 now

Wed, 08 Jul 2015 22:45:00 +0300

Three lines in .travis.yml. That is the whole cost of knowing in July what will break on PHP 7 in December.

php:
  - 5.6
  - nightly
matrix:
  allow_failures:
    - php: nightly

Alpha builds are out, release is planned for this autumn, and production is on 5.6 and will stay there for a while. The build stays green on 5.6. The nightly job fails quietly in the corner and produces a list of future problems while nobody is under pressure to read it.

Laravel 5 and the death of the models folder

Wed, 25 Feb 2015 22:20:00 +0300

app/models is gone. Laravel 5 came out at the start of the month, and of everything in the release the folder I notice most is the one that no longer exists.

The old skeleton had app/models and app/controllers. You knew where things go because the framework told you. Laravel 5 removes that. There is app/, it maps to the App namespace through PSR-4, and inside it you organize classes however you want.

Host header is user input

Tue, 23 Dec 2014 19:20:00 +0300

$link = 'https://'.$_SERVER['HTTP_HOST'].'/reset/'.$token;

I wrote this line. More than once. It builds the link for a password reset email, and it looks like it reads something about the server. It does not. Host comes from the client, same as any other header.

Kohana 3.3.4 shipped this month with a fix around exactly this, and the topic is bigger than one framework.

The attack is short. Someone requests a password reset for your email address and puts his own domain into the Host header. The application trusts the header, builds the link, sends it. You receive a real email from a real site with a link to evil.example and your real token in the path. You click. He collects the token. Host header poisoning, and no framework protects you from it out of the box.

Symfony 2.6: dump() and boring upgrades

Thu, 18 Dec 2014 22:40:00 +0300

dump() instead of var_dump(). Symfony 2.6 came out at the end of November, and this is the visible gift: VarDumper. Collapsible output, clickable class names, works inside the toolbar. A small thing, used fifty times a day. Tools like this improve life more than big features do.

But the important story in 2.6 is not a feature. The release notes read like a preparation checklist for Symfony 3: deprecations, everywhere.

Debug toolbar in production is a gift to strangers

Tue, 09 Dec 2014 21:00:00 +0300

/_profiler on a live site. Type it after any Symfony domain and sometimes it answers. This autumn the story went around, and I will not retell it. The lesson is bigger than one framework.

Think what a profiler actually stores. Every SQL query with parameters. Cookies and session data. Routes, controller names, request headers. Sometimes config values. A full X-ray of your application, nicely formatted, with search.

Now count how many sites have /_profiler or a debugbar open to the world because someone deployed with app_dev.php, or left debug = true in the production config. Not a rare exotic mistake. I saw it. I made it once, on a staging server that stayed reachable from outside longer than anyone planned.

PHP 5.6: small syntax, big TLS surprise

Fri, 05 Dec 2014 19:45:00 +0300

A nightly cron failed silently for two days. That was our PHP 5.6 upgrade.

5.6 is out since the end of August, and we moved one production project this month. The syntax part is pleasant and minor. Variadics:

function log_all($level, ...$messages) { }

Argument unpacking with ...$args on the call side. Constant expressions in defaults. use function for importing functions. All nice. None of it changes your architecture. You will use variadics maybe twice a year and be happy both times.

Services instead of fat controllers

Tue, 02 Dec 2014 22:20:00 +0300

120 lines in one action. Order confirmation: load the order, charge the card, send the email, render the page. It ran fine for a year. Then a console script needed the same operation, and the action turned out to be glued to SMTP, to the database and to the HTTP request. All at once.

Symfony people talk about dependency injection so much it sounds like religion. It is one simple idea: a class receives its dependencies and does not create them.

Queues in Laravel 4.2: the user should not wait for your SMTP

Thu, 27 Nov 2014 20:50:00 +0300

1.8 seconds for one registration request. I put a timer around it on a project last month. 1.5 of those seconds was the welcome email going out over SMTP.

The user waits almost two seconds and looks at a spinner, for a handshake with a mail server he will never hear about.

Laravel 4.2 makes the fix one line:

Queue::push('SendWelcomeEmail', array('user_id' => $user->id));

The controller returns in 300 ms. A worker picks the job up and sends the email. php artisan queue:listen to start, beanstalkd or Redis behind it, the failed_jobs table for jobs that died.

Composer next to Kohana bootstrap

Sun, 23 Nov 2014 21:10:00 +0300

One line in bootstrap.php, above Kohana::init():

require DOCROOT.'vendor/autoload.php';

That is the whole integration. Kohana keeps its modules and its underscore autoloader. Composer brings Packagist. Two autoloaders in one process, and they do not collide: Composer packages use namespaces, Kohana classes have underscores, the lookups never meet.

{
    "require": {
        "guzzlehttp/guzzle": "~5.0"
    }
}

This setup runs in production on one of my projects for a few months. Zero problems from the autoloading side. The problems, when they came, were from me.

Kohana is not developed anymore. Now what

Wed, 19 Nov 2014 19:30:00 +0300

The commit log of kohana/kohana on GitHub. I opened it in the summer and counted: a few merges a month, then fewer, then nothing. This year the official development basically stopped. Our projects did not stop working on that day. But the question came to my inbox three times since, so here is the answer.

What to do with a working Kohana product depends on which of four situations you are in.

Cascading filesystem: the best idea in Kohana

Sun, 16 Nov 2014 22:05:00 +0300

Kohana::find_file(). One function, maybe forty lines. If I could keep only one thing from Kohana, this is the one.

It looks for every file in order: application/, then modules, then system/. First found wins. Config, views, classes, i18n, everything goes through the same lookup.

In practice: a module ships a config file, you put a file with the same name into application/config/, change one key. The module does not know. Nothing under modules/ is touched.

HMVC in Kohana: a request inside a request

Mon, 10 Nov 2014 21:40:00 +0300

Request::factory('widgets/stats') inside a controller. A colleague looked at this line last week and asked the question I hear most often about Kohana: you already have a request, why make another one?

I keep answering it at the desk. So I will write it down once. Short notes, mostly backend, mostly PHP. This is the first.

The answer is composition. Take a dashboard. A stats block, a recent orders block, a notifications block. Each one needs its own data and its own logic. You can put all of it into one action. It works. In a month it is 300 lines and nobody wants to open it.