PHP

D

PHP Intermediate

Dark Mode End to End: OS Preference, Toggle, and No Flash of White

Respect the system setting, let users override it, remember the choice, and never flash the wrong theme on load - the complete wiring across CSS, JS and PHP.

Jun 6, 2026 3 min 119 Read →

4

PHP Intermediate

400-Byte Image Previews: Blur-Up Placeholders with PHP GD

The gray-box loading experience becomes a soft preview of the real image - generated at upload with GD, inlined as a data URI, crossfaded away on load.

May 30, 2026 3 min 79 Read →

I

PHP Intermediate

Instant Search Done Right: Debounce, Abort, Escape, Limit

Search-as-you-type touches four failure modes at once - request spam, stale responses, LIKE wildcards and unbounded scans. The complete pattern, both sides of the wire.

May 26, 2026 3 min 326 Read →

R

PHP Advanced

Rate Limiting Login Attempts Without Locking Anyone Out

Unlimited password guesses is a breach schedule; hard lockouts are a denial-of-service gift. The middle path: counting failures per account AND per IP, with exponential delays.

May 22, 2026 3 min 253 Read →

C

PHP Advanced

CSRF Protection from Scratch: What the Frameworks Are Doing for You

A hidden token, a session comparison, a header for AJAX - the whole defense is 30 lines of PHP and JS. Build it once by hand and framework CSRF errors stop being mysterious.

May 18, 2026 2 min 166 Read →

O

PHP Advanced

OPcache Is the Free 2x Speedup You Haven't Configured

PHP recompiles every file on every request unless OPcache says otherwise - and the default settings leave real performance on the table. Five ini lines, measurable wins.

Apr 7, 2026 3 min 274 Read →

P

PHP Advanced

Protected Downloads That Don't Melt PHP: X-Sendfile and X-Accel-Redirect

Streaming big files through readfile ties up a PHP worker per download. The offload headers let PHP do the auth check, then hand the actual bytes back to the web server.

Apr 2, 2026 2 min 510 Read →

S

PHP Advanced

Serve 304s from PHP: Conditional GETs for Dynamic Content

Browsers are begging to skip downloads they already have - your PHP just never answers. ETag and If-Modified-Since handling turns repeat views into empty 304 responses.

Mar 28, 2026 3 min 315 Read →

S

PHP Intermediate

SameSite, HttpOnly and the __Host- Prefix: Cookies Done Properly

The options-array setcookie signature made secure cookies writable in one call - and the __Host- name prefix gets the browser itself to enforce your security flags.

Mar 20, 2026 3 min 719 Read →

Y

PHP Intermediate

Your LIKE Search Has a Wildcard Injection Bug

Prepared statements stop SQL injection - but % and _ sail straight through into LIKE patterns, letting users dump whole tables or run pathological scans. The fix is three characters of escaping.

Mar 11, 2026 2 min 381 Read →

T

PHP Advanced

Turn PHP Warnings into Exceptions (and Catch Them Like an Adult)

Warnings scroll past in logs while your app continues in a corrupted state. One error handler converts them to catchable ErrorExceptions - and changes how you write file and network code.

Mar 4, 2026 2 min 503 Read →

F

PHP Intermediate

file_get_contents Is a Full HTTP Client (Timeouts, POST and All)

No cURL, no Guzzle, no problem: stream contexts give file_get_contents methods, headers, bodies, timeouts - plus a magic variable that captures response headers.

Feb 26, 2026 2 min 712 Read →