Practical PHP reference

Old systems deserve careful engineering.

Field-tested notes for maintaining, securing, and modernizing PHP applications without losing the behavior that matters.

Current chapters

Work from evidence, not assumptions.

Modernization

Stabilize behavior, expose hidden dependencies, and reduce upgrade risk before changing frameworks or language versions.

Security

Build a validation boundary that treats every browser value as untrusted and returns useful errors without leaking internals.

Data

Use database transactions as explicit business boundaries instead of wrapping arbitrary blocks of PHP in begin and commit calls.

Library

Security

Move uploads through size, type, naming, storage, and access controls before they become reachable content.

Security

Choose the escaping rule at the moment data enters HTML, attributes, URLs, scripts, or structured responses.

Performance

Choose cache keys, scope, invalidation, and observability before adding a cache to a PHP endpoint.

Operations

Build an evidence trail from request ID to logs and traces while keeping errors, secrets, and personal data out of responses.

API engineering

Design request identity, retries, state reconciliation, and failure handling before a trading client is allowed to submit live actions.

Examples are newly written and version-aware; this is not a copy of the former site.

Security advice treats validation, authorization, storage, and output as separate boundaries.