PHP and Laravel

Introduction and Architecture — how PHP serves the web, MVC and the front controller, framework or library, Active Record and Data Mapper, the Symfony components Laravel is built from, Laravel among PHP frameworks and other stacks, and where WordPress and Drupal fit.

The PHP Request Model and Servers — the shared-nothing model, SAPIs, PHP-FPM behind Nginx, FrankenPHP and worker mode, OPcache and persistent connections.

HTTP Requests and Responses — superglobals, JSON, PUT and PATCH bodies, status codes and headers, output buffering, URL parsing with the URI extension, and PSR-7.

Forms, Validation and Output Escaping — Post/Redirect/Get, validating input, escaping for each context, why "sanitize on input" is wrong, and mail header injection.

Sessions and Cookies — how sessions work, the security settings, fixation and hijacking, locking, storage, flash messages, cookies and logging out.

File Uploads and Images — the upload settings, $_FILES, validating and storing uploads, serving downloads, and resizing with GD.

Databases with PDO — connecting, prepared statements and SQL injection, fetch modes, transactions, a repository, and mysqli.

Authentication Without a Framework — registration and login, throttling, "remember me", password reset and HTTP Basic authentication.

Web Security Fundamentals — the PHP Manual’s security chapter, the OWASP Top 10:2025 for PHP, CSRF, injection, SSRF, deserialization, misconfiguration, secrets, headers and patching.

Templating, Routing and Middleware by Hand — PHP as a template language, a front controller and router, PSR-7, PSR-15 and PSR-11, the same application in Slim 4, and why a full framework pays off.

HTTP Clients, APIs and Email — a small JSON API, cURL, stream contexts, PSR-18 clients and sending email.

Laravel Getting Started — installing PHP, Composer and the installer, creating and running an application, the first route-controller-model-view loop, and releases.

Directory Structure and Configuration — the slim skeleton, bootstrap/app.php, .env and config(), environments, debug and maintenance mode.

Request Lifecycle — from index.php through providers, middleware and routing to the response, and what changes under Octane.

Service Container, Providers and Facades — autowiring, bindings and lifetimes, contextual binding, providers, facades and contracts.

Artisan, Tinker and Prompts — the built-in commands, writing commands, Tinker, Laravel Prompts and testing commands.

Routing — route files, parameters, model binding, groups, rate limiting, signed URLs, route caching and Folio.

Middleware — writing and registering middleware, the default groups, parameters and priority, terminable middleware, the #[Middleware] attribute and trusted proxies.

Controllers — basic, single-action and resource controllers, middleware and authorization attributes, injection, and thin controllers with action classes.

Requests, Input and Responses — input, files and cookies, every response type, redirects, downloads and streamed responses.

Validation and Form Requests — rules, errors and old input, Form Requests, rule objects, custom rules and Precognition.

Sessions, Cookies and Flash Data — drivers, flash data, regeneration, JSON serialization in Laravel 13, session blocking and cookies.

Error Handling and Logging — exceptions in bootstrap/app.php, error pages, debug output, log channels, context and Pail.

Blade Templates — layouts, escaping and XSS, JSON for JavaScript, directives, fragments, view composers and page metadata.

Blade Components and Layouts — class and anonymous components, attributes and slots, layouts and component packages.

Vite and Frontend Assets — @vite, static assets, JavaScript frameworks, CSP nonces, choosing a front end and migrating from Mix.

Livewire — Livewire 4 components, wire:model, actions, forms, events, lazy loading, testing, Flux and Alpine.js.

Inertia and Starter Kits — Inertia 3 with React, props and shared data, forms and errors, SSR, testing, and the starter kits.

Database and Query Builder — connections, raw queries and bindings, the query builder, upserts, transactions and locking, and chunking.

Migrations, Seeders and Factories — schema changes, running and squashing migrations, seeders and factories.

Eloquent Models — conventions, Laravel 13 model attributes, mass assignment, events and observers, scopes, soft deletes and strict mode.

Eloquent Relationships — every relationship type, syncing, reading and eager loading.

Eloquent Casts, Accessors and Serialization — casts(), JSON columns, enum and value-object casts, accessors and serialization.

Collections and Pagination — collections, lazy collections, string and array helpers, once(), pipelines and pagination.

Query Performance and N+1 — the N+1 problem, query plans and indexes, eager loading strategies, lazy-loading prevention and finding slow queries.

Redis, MongoDB and Search — Redis, MongoDB with Eloquent, full-text and vector search, and Scout.

Authentication — guards and providers, logging in by hand, e-mail verification, password reset, Fortify with two-factor and passkeys, and Socialite.

Authorization: Gates and Policies — roles, gates, policies and checking abilities everywhere.

API Authentication: Sanctum and Passport — choosing between them, API tokens, SPA authentication and an OAuth 2 server.

Security: CSRF, Encryption and Hashing — PreventRequestForgery, encryption and key rotation, password hashing, CORS, CSP and secrets.

Building APIs and API Resources — API resources, JSON:API resources, versioning, documentation and testing.

HTTP Client — requests, timeouts, retries, configured clients, concurrency and Http::fake().

AI SDK, MCP and Boost — the Laravel AI SDK, MCP servers and Laravel Boost.

Queues and Jobs — drivers, job classes and attributes, workers, failures, transactions, unique jobs, chains and batches, Horizon and idempotency.

Events and Listeners — events, discovery, transactions, model and domain events, and when not to use one.

Broadcasting and Reverb — broadcast events, channel authorization, the protocol, Echo, Reverb in production and server-sent events.

Task Scheduling — the cron entry, schedules, overlaps and several servers, and testing.

Mail and Notifications — mailers, Mailables, queued and translated mail, previews, failover and notifications.

Cache and Rate Limiting — stores, remember and flexible, tags, atomic locks, failover and rate limiting.

File Storage and Images — disks, public and private files, S3, temporary URLs, images and testing.

Localization — translation files, choosing the locale and what Laravel does not translate.

Processes, Concurrency and Context — running processes, the Concurrency facade, Context and feature flags with Pennant.

Testing — the testing environment, Pest, parallel runs and coverage, HTTP and console tests, the database and the fakes.

Browser Testing with Dusk — Dusk and ChromeDriver, page objects, the Pest browser plugin and CI.

Deployment — Nginx and PHP-FPM, optimize and OPcache, releases, long-running processes, FrankenPHP and managed platforms.

Docker and Sail — Sail for development, a production image, and web, worker and scheduler containers from one image.

Octane and Performance — Octane on FrankenPHP, what it gains, state leaks between requests, OPcache and measuring.

Monitoring and Debugging — Telescope, Pulse, Nightwatch, Pail, the exception page and Xdebug.

Package Development and Ecosystem — writing and testing a package, and the first-party and community ecosystem.

What’s Changed and Upgrading — releases 6 to 13, the support policy, old code on Laravel 13, the slim skeleton, upgrading and what older books get wrong.

Best Practices — the practices that still hold, in one checklist.

Cheat Sheet — a one-page summary of the section, with a downloadable PDF.